Play interactive tour

Edit tour

Windows Analysis Report Orderpdf.exe

Overview

General Information

Sample Name:	Orderpdf.exe
Analysis ID:	458217
MD5:	2849c98c8d071260b2618beacf873a98
SHA1:	2431f573d98aaaaa1752b73c4a5f53e8b4660e50
SHA256:	959536bfd1cf19758dde804eaf7e1d38585b573ccf4dc327898979f29cac33a8
Tags:	exeNanoCoreRAT
Infos:
Most interesting Screenshot:

Detection

Nanocore

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Detected Nanocore Rat

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sigma detected: NanoCore

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected Nanocore RAT

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Initial sample is a PE file and has a suspicious name

Machine Learning detection for sample

Maps a DLL or memory area into another process

Uses dynamic DNS services

Uses schtasks.exe or at.exe to add and modify task schedules

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains strange resources

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

Orderpdf.exe (PID: 1268 cmdline: 'C:\Users\user\Desktop\Orderpdf.exe' MD5: 2849C98C8D071260B2618BEACF873A98)

MSBuild.exe (PID: 5876 cmdline: 'C:\Users\user\Desktop\Orderpdf.exe' MD5: 88BBB7610152B48C2B3879473B17857E)

schtasks.exe (PID: 4436 cmdline: 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp86BE.tmp' MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 1636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

MSBuild.exe (PID: 6004 cmdline: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 0 MD5: 88BBB7610152B48C2B3879473B17857E)

conhost.exe (PID: 6076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: NanoCore

{"Version": "1.2.2.0", "Mutex": "8a1be7ed-1b25-4346-8844-80b424a6", "Group": "Default", "Domain1": "sobe123.ddns.net", "Domain2": "127.0.0.1", "Port": 5656, "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5024, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n  <RegistrationInfo />\r\n  <Triggers />\r\n  <Principals>\r\n    <Principal id=\"Author\">\r\n      <LogonType>InteractiveToken</LogonType>\r\n      <RunLevel>HighestAvailable</RunLevel>\r\n    </Principal>\r\n  </Principals>\r\n  <Settings>\r\n    <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n    <AllowHardTerminate>true</AllowHardTerminate>\r\n    <StartWhenAvailable>false</StartWhenAvailable>\r\n    <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n    <IdleSettings>\r\n      <StopOnIdleEnd>false</StopOnIdleEnd>\r\n      <RestartOnIdle>false</RestartOnIdle>\r\n    </IdleSettings>\r\n    <AllowStartOnDemand>true</AllowStartOnDemand>\r\n    <Enabled>true</Enabled>\r\n    <Hidden>false</Hidden>\r\n    <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n    <WakeToRun>false</WakeToRun>\r\n    <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n    <Priority>4</Priority>\r\n  </Settings>\r\n  <Actions Context=\"Author\">\r\n    <Exec>\r\n      <Command>\"#EXECUTABLEPATH\"</Command>\r\n      <Arguments>$(Arg0)</Arguments>\r\n    </Exec>\r\n  </Actions>\r\n</Task"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.205053043.0000000002120000.00000040.00000001.sdmp	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
00000000.00000002.205053043.0000000002120000.00000040.00000001.sdmp	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
00000000.00000002.205053043.0000000002120000.00000040.00000001.sdmp	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
00000000.00000002.205053043.0000000002120000.00000040.00000001.sdmp	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
Process Memory Space: Orderpdf.exe PID: 1268	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x70948:$x1: NanoCore.ClientPluginHost 0x70985:$x2: IClientNetworkHost 0x74476:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe 0x7f4e4:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
Process Memory Space: Orderpdf.exe PID: 1268	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
Process Memory Space: Orderpdf.exe PID: 1268	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0x70615:$a: NanoCore 0x70625:$a: NanoCore 0x706e4:$a: NanoCore 0x706f3:$a: NanoCore 0x708f4:$a: NanoCore 0x70908:$a: NanoCore 0x70948:$a: NanoCore 0x7bb4e:$a: NanoCore 0x7bb60:$a: NanoCore 0x7bb9c:$a: NanoCore 0x70674:$b: ClientPlugin 0x7073d:$b: ClientPlugin 0x70911:$b: ClientPlugin 0x70951:$b: ClientPlugin 0x7bb69:$b: ClientPlugin 0x7bba5:$b: ClientPlugin 0x70836:$c: ProjectData 0x7ba9b:$c: ProjectData 0x7120a:$d: DESCrypto 0x7c3f9:$d: DESCrypto 0x78bc7:$e: KeepAlive
Click to see the 2 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.Orderpdf.exe.2120000.1.raw.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0x1018d:$x1: NanoCore.ClientPluginHost 0x101ca:$x2: IClientNetworkHost 0x13cfd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.Orderpdf.exe.2120000.1.raw.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xff05:$x1: NanoCore Client.exe 0x1018d:$x2: NanoCore.ClientPluginHost 0x117c6:$s1: PluginCommand 0x117ba:$s2: FileCommand 0x1266b:$s3: PipeExists 0x18422:$s4: PipeCreated 0x101b7:$s5: IClientLoggingHost
0.2.Orderpdf.exe.2120000.1.raw.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.Orderpdf.exe.2120000.1.raw.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xfef5:$a: NanoCore 0xff05:$a: NanoCore 0x10139:$a: NanoCore 0x1014d:$a: NanoCore 0x1018d:$a: NanoCore 0xff54:$b: ClientPlugin 0x10156:$b: ClientPlugin 0x10196:$b: ClientPlugin 0x1007b:$c: ProjectData 0x10a82:$d: DESCrypto 0x1844e:$e: KeepAlive 0x1643c:$g: LogClientMessage 0x12637:$i: get_Connected 0x10db8:$j: #=q 0x10de8:$j: #=q 0x10e04:$j: #=q 0x10e34:$j: #=q 0x10e50:$j: #=q 0x10e6c:$j: #=q 0x10e9c:$j: #=q 0x10eb8:$j: #=q
0.2.Orderpdf.exe.2120000.1.unpack	Nanocore_RAT_Gen_2	Detetcs the Nanocore RAT	Florian Roth	0xe38d:$x1: NanoCore.ClientPluginHost 0xe3ca:$x2: IClientNetworkHost 0x11efd:$x3: #=qjgz7ljmpp0J7FvL9dmi8ctJILdgtcbw8JYUc6GC8MeJ9B11Crfg2Djxcf0p8PZGe
0.2.Orderpdf.exe.2120000.1.unpack	Nanocore_RAT_Feb18_1	Detects Nanocore RAT	Florian Roth	0xe105:$x1: NanoCore Client.exe 0xe38d:$x2: NanoCore.ClientPluginHost 0xf9c6:$s1: PluginCommand 0xf9ba:$s2: FileCommand 0x1086b:$s3: PipeExists 0x16622:$s4: PipeCreated 0xe3b7:$s5: IClientLoggingHost
0.2.Orderpdf.exe.2120000.1.unpack	JoeSecurity_Nanocore	Yara detected Nanocore RAT	Joe Security
0.2.Orderpdf.exe.2120000.1.unpack	NanoCore	unknown	Kevin Breen <kevin@techanarchy.net>	0xe0f5:$a: NanoCore 0xe105:$a: NanoCore 0xe339:$a: NanoCore 0xe34d:$a: NanoCore 0xe38d:$a: NanoCore 0xe154:$b: ClientPlugin 0xe356:$b: ClientPlugin 0xe396:$b: ClientPlugin 0xe27b:$c: ProjectData 0xec82:$d: DESCrypto 0x1664e:$e: KeepAlive 0x1463c:$g: LogClientMessage 0x10837:$i: get_Connected 0xefb8:$j: #=q 0xefe8:$j: #=q 0xf004:$j: #=q 0xf034:$j: #=q 0xf050:$j: #=q 0xf06c:$j: #=q 0xf09c:$j: #=q 0xf0b8:$j: #=q
Click to see the 3 entries

Sigma Overview

AV Detection:

Sigma detected: NanoCore

Show sources

Source: File created

Author: Joe Security: Data: EventID: 11, Image: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe, ProcessId: 5876, TargetFilename: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat

E-Banking Fraud:

Sigma detected: NanoCore

Show sources

Source: File created

Stealing of Sensitive Information:

Sigma detected: NanoCore

Show sources

Source: File created

Remote Access Functionality:

Sigma detected: NanoCore

Show sources

Source: File created

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 0.2.Orderpdf.exe.2120000.1.raw.unpack

Malware Configuration Extractor: NanoCore {"Version": "1.2.2.0", "Mutex": "8a1be7ed-1b25-4346-8844-80b424a6", "Group": "Default", "Domain1": "sobe123.ddns.net", "Domain2": "127.0.0.1", "Port": 5656, "RunOnStartup": "Disable", "RequestElevation": "Disable", "BypassUAC": "Enable", "ClearZoneIdentifier": "Enable", "ClearAccessControl": "Disable", "SetCriticalProcess": "Disable", "PreventSystemSleep": "Enable", "ActivateAwayMode": "Disable", "EnableDebugMode": "Disable", "RunDelay": 0, "ConnectDelay": 4000, "RestartDelay": 5000, "TimeoutInterval": 5024, "KeepAliveTimeout": 30000, "MutexTimeout": 5000, "LanTimeout": 2500, "WanTimeout": 8000, "BufferSize": "ffff0000", "MaxPacketSize": "0000a000", "GCThreshold": "0000a000", "UseCustomDNS": "Enable", "PrimaryDNSServer": "8.8.8.8", "BackupDNSServer": "8.8.4.4", "BypassUserAccountControlData": "<?xml version=\"1.0\" encoding=\"UTF-16\"?>\r\n<Task version=\"1.2\" xmlns=\"http://schemas.microsoft.com/windows/2004/02/mit/task\">\r\n <RegistrationInfo />\r\n <Triggers />\r\n <Principals>\r\n <Principal id=\"Author\">\r\n <LogonType>InteractiveToken</LogonType>\r\n <RunLevel>HighestAvailable</RunLevel>\r\n </Principal>\r\n </Principals>\r\n <Settings>\r\n <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>\r\n <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>\r\n <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>\r\n <AllowHardTerminate>true</AllowHardTerminate>\r\n <StartWhenAvailable>false</StartWhenAvailable>\r\n <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>\r\n <IdleSettings>\r\n <StopOnIdleEnd>false</StopOnIdleEnd>\r\n <RestartOnIdle>false</RestartOnIdle>\r\n </IdleSettings>\r\n <AllowStartOnDemand>true</AllowStartOnDemand>\r\n <Enabled>true</Enabled>\r\n <Hidden>false</Hidden>\r\n <RunOnlyIfIdle>false</RunOnlyIfIdle>\r\n <WakeToRun>false</WakeToRun>\r\n <ExecutionTimeLimit>PT0S</ExecutionTimeLimit>\r\n <Priority>4</Priority>\r\n </Settings>\r\n <Actions Context=\"Author\">\r\n <Exec>\r\n <Command>\"#EXECUTABLEPATH\"</Command>\r\n <Arguments>$(Arg0)</Arguments>\r\n </Exec>\r\n </Actions>\r\n</Task"}

Multi AV Scanner detection for submitted file

Show sources

Source: Orderpdf.exe	Virustotal: Detection: 27%			Perma Link
Source: Orderpdf.exe	ReversingLabs: Detection: 21%

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0.2.Orderpdf.exe.2120000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Orderpdf.exe.2120000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.205053043.0000000002120000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Orderpdf.exe PID: 1268, type: MEMORYSTR

Machine Learning detection for sample

Show sources

Source: Orderpdf.exe

Joe Sandbox ML: detected

Source: Orderpdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source:	Binary string: wntdll.pdbUGP source: Orderpdf.exe, 00000000.00000003.202490567.0000000002470000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: Orderpdf.exe, 00000000.00000003.202490567.0000000002470000.00000004.00000001.sdmp

Source: C:\Users\user\Desktop\Orderpdf.exe

Code function: 0_2_0042E672 FindFirstFileExW,

0_2_0042E672

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49706 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49714 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49720 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49726 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49729 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49731 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49732 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49733 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49742 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49743 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49744 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49745 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49746 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49749 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49753 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49755 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49756 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49757 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49758 -> 185.244.30.22:5656
Source: Traffic	Snort IDS: 2025019 ET TROJAN Possible NanoCore C2 60B 192.168.2.3:49759 -> 185.244.30.22:5656

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: sobe123.ddns.net
Source: Malware configuration extractor	URLs: 127.0.0.1

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: sobe123.ddns.net

Source: global traffic

TCP traffic: 192.168.2.3:49706 -> 185.244.30.22:5656

Source: Joe Sandbox View

IP Address: 185.244.30.22 185.244.30.22

Source: Joe Sandbox View

ASN Name: DAVID_CRAIGGG DAVID_CRAIGGG

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.71
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.160.71

Source: unknown

DNS traffic detected: queries for: sobe123.ddns.net

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

E-Banking Fraud:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0.2.Orderpdf.exe.2120000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Orderpdf.exe.2120000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.205053043.0000000002120000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Orderpdf.exe PID: 1268, type: MEMORYSTR

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 0.2.Orderpdf.exe.2120000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Orderpdf.exe.2120000.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 0.2.Orderpdf.exe.2120000.1.unpack, type: UNPACKEDPE	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 0.2.Orderpdf.exe.2120000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: 00000000.00000002.205053043.0000000002120000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: 00000000.00000002.205053043.0000000002120000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>
Source: Process Memory Space: Orderpdf.exe PID: 1268, type: MEMORYSTR	Matched rule: Detetcs the Nanocore RAT Author: Florian Roth
Source: Process Memory Space: Orderpdf.exe PID: 1268, type: MEMORYSTR	Matched rule: NanoCore Author: Kevin Breen <kevin@techanarchy.net>

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: Orderpdf.exe

Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_00477095	0_2_00477095
Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_00430525	0_2_00430525
Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_0042CA20	0_2_0042CA20
Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_00416A80	0_2_00416A80
Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_00426F60	0_2_00426F60
Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_0042502A	0_2_0042502A
Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_0042D129	0_2_0042D129
Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_00425287	0_2_00425287
Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_00419340	0_2_00419340
Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_00433646	0_2_00433646
Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_00433766	0_2_00433766
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Code function: 4_2_02A30708	4_2_02A30708

Source: C:\Users\user\Desktop\Orderpdf.exe

Code function: String function: 00421060 appears 33 times

Source: Orderpdf.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: Orderpdf.exe, 00000000.00000003.201065384.00000000023F6000.00000004.00000001.sdmp

Binary or memory string: OriginalFilenamentdll.dllj% vs Orderpdf.exe

Source: Orderpdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: 0.2.Orderpdf.exe.2120000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Orderpdf.exe.2120000.1.raw.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Orderpdf.exe.2120000.1.raw.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 0.2.Orderpdf.exe.2120000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 0.2.Orderpdf.exe.2120000.1.unpack, type: UNPACKEDPE	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 0.2.Orderpdf.exe.2120000.1.unpack, type: UNPACKEDPE	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: 00000000.00000002.205053043.0000000002120000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: 00000000.00000002.205053043.0000000002120000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Nanocore_RAT_Feb18_1 date = 2018-02-19, hash1 = aa486173e9d594729dbb5626748ce10a75ee966481b68c1b4f6323c827d9658c, author = Florian Roth, description = Detects Nanocore RAT, reference = Internal Research - T2T, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000000.00000002.205053043.0000000002120000.00000040.00000001.sdmp, type: MEMORY	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore
Source: Process Memory Space: Orderpdf.exe PID: 1268, type: MEMORYSTR	Matched rule: Nanocore_RAT_Gen_2 date = 2016-04-22, hash1 = 755f49a4ffef5b1b62f4b5a5de279868c0c1766b528648febf76628f1fe39050, author = Florian Roth, description = Detetcs the Nanocore RAT, license = https://creativecommons.org/licenses/by-nc/4.0/, score = https://www.sentinelone.com/blogs/teaching-an-old-rat-new-tricks/
Source: Process Memory Space: Orderpdf.exe PID: 1268, type: MEMORYSTR	Matched rule: NanoCore date = 2014/04, filetype = exe, author = Kevin Breen <kevin@techanarchy.net>, maltype = Remote Access Trojan, ref = http://malwareconfig.com/stats/NanoCore

Source: MSBuild.exe, 00000004.00000002.214099841.0000000002F71000.00000004.00000001.sdmp

Binary or memory string: *.sln

Source: classification engine

Classification label: mal100.troj.evad.winEXE@8/6@20/2

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

File created: C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\{8a1be7ed-1b25-4346-8844-80b424a6856e}
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net clr networking
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6076:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1636:120:WilError_01

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

File created: C:\Users\user\AppData\Local\Temp\tmp86BE.tmp

Jump to behavior

Source: C:\Users\user\Desktop\Orderpdf.exe

Command line argument: .KC

0_2_00434A80

Source: Orderpdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior

Source: C:\Users\user\Desktop\Orderpdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Orderpdf.exe	Virustotal: Detection: 27%
Source: Orderpdf.exe	ReversingLabs: Detection: 21%

Source: C:\Users\user\Desktop\Orderpdf.exe

File read: C:\Users\user\Desktop\Orderpdf.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Orderpdf.exe 'C:\Users\user\Desktop\Orderpdf.exe'
Source: C:\Users\user\Desktop\Orderpdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 'C:\Users\user\Desktop\Orderpdf.exe'
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp86BE.tmp'
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 0
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Orderpdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 'C:\Users\user\Desktop\Orderpdf.exe'	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp86BE.tmp'	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\InprocServer32

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: Orderpdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wntdll.pdbUGP source: Orderpdf.exe, 00000000.00000003.202490567.0000000002470000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdb source: Orderpdf.exe, 00000000.00000003.202490567.0000000002470000.00000004.00000001.sdmp

Source: C:\Users\user\Desktop\Orderpdf.exe

Code function: 0_2_004210A6 push ecx; ret

0_2_004210B9

Boot Survival:

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp86BE.tmp'

Hooking and other Techniques for Hiding and Protection:

Hides that the sample has been downloaded from the Internet (zone.identifier)

Show sources

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Window / User API: threadDelayed 405	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Window / User API: foregroundWindowGot 1041	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Window / User API: foregroundWindowGot 354	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 5928	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 5984	Thread sleep time: -460000s >= -30000s	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe TID: 5608	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\Orderpdf.exe

Code function: 0_2_0042E672 FindFirstFileExW,

0_2_0042E672

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Orderpdf.exe

Code function: 0_2_0042B27F IsDebuggerPresent,OutputDebugStringW,

0_2_0042B27F

Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_00477095 mov eax, dword ptr fs:[00000030h]	0_2_00477095
Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_0042E361 mov eax, dword ptr fs:[00000030h]	0_2_0042E361
Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_0042E3D6 mov eax, dword ptr fs:[00000030h]	0_2_0042E3D6
Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_0042E3A5 mov eax, dword ptr fs:[00000030h]	0_2_0042E3A5
Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_00427A76 mov eax, dword ptr fs:[00000030h]	0_2_00427A76

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_00420F38 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00420F38
Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_004212D2 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004212D2
Source: C:\Users\user\Desktop\Orderpdf.exe	Code function: 0_2_00425E37 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00425E37

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Maps a DLL or memory area into another process

Show sources

Source: C:\Users\user\Desktop\Orderpdf.exe

Section loaded: unknown target: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe protection: execute and read and write

Jump to behavior

Source: C:\Users\user\Desktop\Orderpdf.exe	Process created: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 'C:\Users\user\Desktop\Orderpdf.exe'			Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp86BE.tmp'			Jump to behavior

Source: MSBuild.exe, 00000001.00000003.434382108.00000000013BC000.00000004.00000001.sdmp	Binary or memory string: Program Managersoft.NET\Framework\v2.0.50727\MSBuild.exe
Source: MSBuild.exe, 00000001.00000003.308640440.00000000013BC000.00000004.00000001.sdmp	Binary or memory string: Program Managersoft.NET\Framework\v2.0.50727\MSBuild.exet

Source: C:\Users\user\Desktop\Orderpdf.exe

Code function: 0_2_00421128 cpuid

0_2_00421128

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe	Queries volume information: C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Orderpdf.exe

Code function: 0_2_004214BC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_004214BC

Source: C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0.2.Orderpdf.exe.2120000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Orderpdf.exe.2120000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.205053043.0000000002120000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Orderpdf.exe PID: 1268, type: MEMORYSTR

Remote Access Functionality:

Detected Nanocore Rat

Show sources

Source: Orderpdf.exe, 00000000.00000002.205053043.0000000002120000.00000040.00000001.sdmp

String found in binary or memory: NanoCore.ClientPluginHost

Yara detected Nanocore RAT

Show sources

Source: Yara match	File source: 0.2.Orderpdf.exe.2120000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Orderpdf.exe.2120000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.205053043.0000000002120000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Orderpdf.exe PID: 1268, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter2	Scheduled Task/Job1	Process Injection112	Masquerading1	OS Credential Dumping	System Time Discovery1	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Encrypted Channel12	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job1	Boot or Logon Initialization Scripts	Scheduled Task/Job1	Disable or Modify Tools1	LSASS Memory	Security Software Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Standard Port1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion21	Security Account Manager	Process Discovery2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Remote Access Software1	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Process Injection112	NTDS	Virtualization/Sandbox Evasion21	Distributed Component Object Model	Input Capture	Scheduled Transfer	Non-Application Layer Protocol1	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Deobfuscate/Decode Files or Information1	LSA Secrets	Application Window Discovery1	SSH	Keylogging	Data Transfer Size Limits	Application Layer Protocol22	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Hidden Files and Directories1	Cached Domain Credentials	File and Directory Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information2	DCSync	System Information Discovery23	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Orderpdf.exe	28%	Virustotal		Browse
Orderpdf.exe	22%	ReversingLabs	Win32.Trojan.NanoBot
Orderpdf.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
127.0.0.1	0%	Virustotal		Browse
127.0.0.1	0%	Avira URL Cloud	safe
sobe123.ddns.net	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
sobe123.ddns.net	185.244.30.22	true	true		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
127.0.0.1	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
sobe123.ddns.net	true	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.244.30.22	sobe123.ddns.net	Netherlands		209623	DAVID_CRAIGGG	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	458217
Start date:	03.08.2021
Start time:	03:31:10
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Orderpdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	33
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@8/6@20/2
EGA Information:	Failed
HDC Information:	Failed
HCA Information:	Successful, ratio: 67% Number of executed functions: 48 Number of non-executed functions: 50
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information. Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe Excluded IPs from analysis (whitelisted): 52.255.188.83, 52.147.198.201, 104.42.151.234, 20.50.102.62, 23.211.4.86, 80.67.82.211, 80.67.82.235, 40.112.88.60, 23.211.6.115 Excluded domains from analysis (whitelisted): fs.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, skypedataprdcoleus16.cloudapp.net, ris.api.iris.microsoft.com, e12564.dspb.akamaiedge.net, skypedataprdcoleus17.cloudapp.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, skypedataprdcolwus16.cloudapp.net Not all processes where analyzed, report is missing behavior information

Simulations

Behavior and APIs

Time	Type	Description
03:32:00	API Interceptor	1064x Sleep call for process: MSBuild.exe modified
03:32:02	Task Scheduler	Run new task: DHCP Monitor path: "C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe" s>$(Arg0)

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
185.244.30.22	Permintaan Baru 0010.exe	Get hash	malicious	Browse
	Shipping document PL and BL0070,pdf.exe	Get hash	malicious	Browse
	Shipping document PL and BL0070,pdf.exe	Get hash	malicious	Browse
	Shipping document PL and BL0070,pdf.exe	Get hash	malicious	Browse
	AWB 686553534 L#U00f4 h#U00e0ng ,pdf.exe	Get hash	malicious	Browse

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
DAVID_CRAIGGG	d1IaoX0mpm.exe	Get hash	malicious	Browse	185.140.53.6
	ORDER LIST.xlsx	Get hash	malicious	Browse	185.140.53.6
	8146Q5rN9g.exe	Get hash	malicious	Browse	91.193.75.162
	Scanned Documents 001.doc	Get hash	malicious	Browse	91.193.75.162
	Quotation Request August RFQ8012021.exe	Get hash	malicious	Browse	185.140.53.253
	NEW PO pdf.exe	Get hash	malicious	Browse	91.193.75.162
	Permintaan Baru 0010.exe	Get hash	malicious	Browse	185.244.30.22
	5yvgVnT8wz.exe	Get hash	malicious	Browse	185.244.30.23
	LxYbtlP5nB.exe	Get hash	malicious	Browse	185.244.30.23
	eInFMnZWWV.exe	Get hash	malicious	Browse	185.244.30.143
	Purchase order FOD-0056-2021-D.exe	Get hash	malicious	Browse	91.193.75.162
	ARRIVAL NOTICE FOR NEW ORDER190009.exe	Get hash	malicious	Browse	185.140.53.142
	Quotation RequestQR28072021.exe	Get hash	malicious	Browse	185.140.53.253
	Spare Parts Requisition-003,004.exe	Get hash	malicious	Browse	185.244.30.238
	Order List.exe	Get hash	malicious	Browse	91.193.75.228
	Quote 992002892.doc	Get hash	malicious	Browse	185.244.30.238
	4FNiWwUTLR.exe	Get hash	malicious	Browse	185.244.30.238
	PMA21-110.exe	Get hash	malicious	Browse	91.193.75.228
	PEDIDO DE COMPRA ASHCROFT - 41901E-001,pdf.exe	Get hash	malicious	Browse	185.140.53.11
	Quotation.exe	Get hash	malicious	Browse	185.244.30.53

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\MSBuild.exe.log Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	325
Entropy (8bit):	5.334380084018418
Encrypted:	false
SSDEEP:	6:Q3LadLCR22IAQykdL1tZbLsbFLIP12MUAvvro6ysGMFLIP12MUAvvrs:Q3LaJU20NaL1tZbgbe4MqJsGMe4M6
MD5:	65CE98936A67552310EFE2F0FF5BDF88
SHA1:	8133653A6B9A169C7496ADE315CED322CFC3613A
SHA-256:	682F7C55B1B6E189D17755F74959CD08762F91373203B3B982ACFFCADE2E871A
SHA-512:	2D00AC024267EC384720A400F6D0B4F7EDDF49FAF8AB3C9E6CBFBBAE90ECADACA9022B33E3E8EC92E4F57C7FC830299C8643235EB4AA7D8A6AFE9DD1775F57C3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1ffc437de59fb69ba2b865ffdc98ffd1\System.ni.dll",0..2,"Microsoft.Build.Engine, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.Build.Framework, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..

C:\Users\user\AppData\Local\Temp\tmp86BE.tmp Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	5.136963558289723
Encrypted:	false
SSDEEP:	24:2dH4+S/4oL600QlMhEMjn5pwjVLUYODOLG9RJh7h8gK0mnc2xtn:cbk4oL600QydbQxIYODOLedq3ZLj
MD5:	AE766004C0D8792953BAFFFE8F6A2E3B
SHA1:	14B12F27543A401E2FE0AF8052E116CAB0032426
SHA-256:	1ABDD9B6A6B84E4BA1AF1282DC84CE276C59BA253F4C4AF05FEA498A4FD99540
SHA-512:	E530DA4A5D4336FC37838D0E93B5EB3804B9C489C71F6954A47FC81A4C655BB72EC493E109CF96E6E3617D7623AC80697AD3BBD5FFC6281BAFC8B34DCA5E6567
Malicious:	true
Reputation:	moderate, very likely benign file
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo />.. <Triggers />.. <Principals>.. <Principal id="Author">.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>HighestAvailable</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>Parallel</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>.. <AllowHardTerminate>true</AllowHardTerminate>.. <StartWhenAvailable>false</StartWhenAvailable>.. <RunOnlyIfNetworkAvailable>false</RunOnlyIfNetworkAvailable>.. <IdleSettings>.. <StopOnIdleEnd>false</StopOnIdleEnd>.. <RestartOnIdle>false</RestartOnIdle>.. </IdleSettings>.. <AllowStartOnDemand>true</AllowStartOnDemand>.. <Enabled>true</Enabled>.. <Hidden>false</Hidden>.. <RunOnlyIfIdle>false</RunOnlyIfIdle>.. <Wak

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\catalog.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	2320
Entropy (8bit):	7.089541637477408
Encrypted:	false
SSDEEP:	48:IknjhUknjhUknjhUknjhUknjhUknjhUknjhUknjhUknjhUknjhL:HjhDjhDjhDjhDjhDjhDjhDjhDjhDjhL
MD5:	2CC2E05CB39A76B255530F61BA4AA2E3
SHA1:	76BD6001B1922B2B3FB2F618740FA74A6C532A7F
SHA-256:	FBF89196FF1A9FC33EE6C42DC0A959DAA89E2322F3417C77534C9968C0885271
SHA-512:	2EACD3A81456781803A9C14F7471DBBDB126BBE7AEC3105B1A49AB115A8BB831EA0D1DF48BAB00EB8231B114EAE5A03DF73A7A60B45BA03CB2F92382CF4DBB38
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+..........~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+..........~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+..........~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.... S....}FF.2...h.M+....L.#.X..+..........~f.G0^..;....W2.=...K.~.L..&f...p............:7rH}..../H......L...?...A.K...J.=8x!....+.2e'..E?.G......[.&Gj.h\.3.A...5.x..&...i+..c(1.P..P.cLT...A.b........4h...t.+..Z\.. .i.

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\run.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:6vtn:6vt
MD5:	604254C4E0DED10AC094C2AEFF16A952
SHA1:	D0CCCC461EE99F9C1D7DE9045FEBE2BB8753597C
SHA-256:	9C14AE70F96EB4C5BCCADA9E26DE13EB95ED53E08D10F2283F51049A3381E5E9
SHA-512:	14229C84CA48525291DE039DC041A053ABAEBCFA17E7A351A36CC8BF06971A2A4CBC77DB5E4B019918961F2790AD4C63946A26A5240066924C06539C9CAD6394
Malicious:	true
Reputation:	low
Preview:	....iV.H

C:\Users\user\AppData\Roaming\D06ED635-68F6-4E9A-955C-4899F5F57B9A\task.dat Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.85263908467479
Encrypted:	false
SSDEEP:	3:oMty8WbSI1u:oMLWuI1u
MD5:	A35128E4E28B27328F70E4E8FF482443
SHA1:	B89066B2F8DB34299AABFD7ABEE402D5444DD079
SHA-256:	88AEA00733DC4B570A29D56A423CC5BF163E5ACE7AF349972EB0BBA8D9AD06E1
SHA-512:	F098E844B5373B34642B49B6E0F2E15CFDAA1A8B6CABC2196CEC0F3765289E5B1FD4AB588DD65F97C8E51FA9A81077621E9A06946859F296904C646906A70F33
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe

\Device\ConDrv Download File
Process:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	235
Entropy (8bit):	5.107306146099542
Encrypted:	false
SSDEEP:	6:zx3M1tlAX8bSWR30qysGMQbSVRRZBXVRbJ0fFPRAgRYan:zK1XnV30ZsGMIG9BFRbQ5AUYan
MD5:	67DDD8252A246E7B14649B0063E351C0
SHA1:	AAE1C6839D1CC4A626D0FB2D4773823AD209FA17
SHA-256:	24C8283BA3F7FCA2E4CEF6F141263DD1E8A36E5A5CD96A97BFE83525D7663116
SHA-512:	326A5E0A440F60D4808C91499F1F3616C496B67DC053B4A2A40B0FE09002074AE5365018781F8746E98E7E3CFCD35F1310D17FB7C2138A8157318E6791987025
Malicious:	false
Preview:	Microsoft (R) Build Engine Version 2.0.50727.8922..[Microsoft .NET Framework, Version 2.0.50727.8922]..Copyright (C) Microsoft Corporation 2005. All rights reserved.....MSBUILD : error MSB1009: Project file does not exist...Switch: 0..

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.186849273906373
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Orderpdf.exe
File size:	869938
MD5:	2849c98c8d071260b2618beacf873a98
SHA1:	2431f573d98aaaaa1752b73c4a5f53e8b4660e50
SHA256:	959536bfd1cf19758dde804eaf7e1d38585b573ccf4dc327898979f29cac33a8
SHA512:	0e84db59a75e6010953f247e74716996f7c652d7b9a541dd3407aa5284958c17c7cb3750d638240410feaea4804fe5d700fc4303eb0f18a5b96ef1833553efab
SSDEEP:	12288:f1Wl8T5UM63xjmelf+6QY+IffW3TLueA0b:fA2adx06QYffaLNb
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......;$G..E)].E)].E)]k.\kE)]k.,\.E)]k.-\eE)]D.\kE)]D.,\DE)]D.-\]E)]k.(\vE)].E(].E)]..,\vE)]...]~E)].E.]~E)]..+\~E)]Rich.E)].......

File Icon


Icon Hash:	00ecf0f0e8ecf400

Static PE Info

General
Entrypoint:	0x420e4a
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED
DLL Characteristics:	TERMINAL_SERVER_AWARE, NX_COMPAT
Time Stamp:	0x61087E6E [Mon Aug 2 23:23:26 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	49be0836dac021f86af2cb207b4613c8

Entrypoint Preview

Instruction
call 00007F1ED0C53BF2h
jmp 00007F1ED0C53413h
jmp dword ptr [0043617Ch]
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [00477304h]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], esp
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
int3
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 0Fh
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F1ED0C52DCFh
push ecx
lea ecx, dword ptr [esp+08h]
sub ecx, eax
and ecx, 07h
add eax, ecx
sbb ecx, ecx
or eax, ecx
pop ecx
jmp 00007F1ED0C52DB9h
int3
int3
int3
int3
push ebx
push esi
mov eax, dword ptr [esp+18h]
or eax, eax
jne 00007F1ED0C5359Ah
mov ecx, dword ptr [esp+14h]
mov eax, dword ptr [esp+10h]
xor edx, edx
div ecx
mov ebx, eax
mov eax, dword ptr [esp+0Ch]
div ecx
mov edx, ebx
jmp 00007F1ED0C535C3h
mov ecx, eax
mov ebx, dword ptr [esp+14h]
mov edx, dword ptr [esp+10h]
mov eax, dword ptr [esp+0Ch]
shr ecx, 1
rcr ebx, 1
shr edx, 1
rcr eax, 1
or ecx, ecx
jne 00007F1ED0C53576h
div ebx
mov esi, eax
mul dword ptr [eax+eax+00h]

Rich Headers

Programming Language:

[C++] VS2015 UPD3.1 build 24215
[LNK] VS2015 UPD3.1 build 24215
[RES] VS2015 UPD3 build 24213

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7602c	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7b000	0x294e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x74950	0x38	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x749e4	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x74988	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x36000	0x17c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x34912	0x34a00	False	0.446050141033	data	6.54583953865	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rdata	0x36000	0x408b6	0x40a00	False	0.257729388298	data	4.10647165512	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x77000	0x1e08	0x1000	False	0.296630859375	DOS executable (COM)	3.39752271911	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.gfids	0x79000	0x150	0x200	False	0.33203125	data	1.72024643613	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x7a000	0x9	0x200	False	0.033203125	data	0.0203931352361	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x7b000	0x294e0	0x29600	False	0.0884688916163	data	3.29281992913	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_ICON	0x7b270	0x18a7	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x7cb18	0x10828	dBase IV DBT, blocks size 0, block length 2048, next free block index 40, next free block 0, next used block 0	English	United States
RT_ICON	0x8d340	0x94a8	data	English	United States
RT_ICON	0x967e8	0x5488	data	English	United States
RT_ICON	0x9bc70	0x4228	dBase IV DBT of \200.DBF, blocks size 0, block length 16896, next free block index 40, next free block 4294967295, next used block 4294967295	English	United States
RT_ICON	0x9fe98	0x25a8	data	English	United States
RT_ICON	0xa2440	0x10a8	data	English	United States
RT_ICON	0xa34e8	0x988	data	English	United States
RT_ICON	0xa3e70	0x468	GLS_BINARY_LSB_FIRST	English	United States
RT_GROUP_ICON	0xa42d8	0x84	data	English	United States
RT_MANIFEST	0xa4360	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
KERNEL32.dll	OutputDebugStringW, FormatMessageW, VirtualProtect, HeapSize, GetConsoleMode, GetConsoleOutputCP, FlushFileBuffers, SetFilePointerEx, GetFileSizeEx, SetStdHandle, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, GetCommandLineA, GetOEMCP, GetACP, IsValidCodePage, FindNextFileW, FindFirstFileExW, FindClose, GetProcessHeap, WriteFile, ExitProcess, HeapReAlloc, HeapFree, HeapAlloc, WriteConsoleW, GetModuleHandleExW, GetModuleFileNameW, GetFileType, GetStdHandle, LoadLibraryExW, WideCharToMultiByte, MultiByteToWideChar, GetStringTypeW, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, EncodePointer, DecodePointer, SetLastError, InitializeCriticalSectionAndSpinCount, CreateEventW, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, GetSystemTimeAsFileTime, GetModuleHandleW, GetProcAddress, LCMapStringW, GetCPInfo, CloseHandle, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, IsDebuggerPresent, GetStartupInfoW, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, InitializeSListHead, RaiseException, RtlUnwind, GetLastError, FreeLibrary, CreateFileW
USER32.dll	GrayStringA, GetDC, TranslateMessage, DispatchMessageW, PeekMessageW, DefWindowProcW, PostQuitMessage, UnregisterClassW, RegisterClassExW, CreateWindowExW, ShowWindow, SetCapture, ReleaseCapture, LoadImageW, LoadCursorW, SetWindowLongW, GetWindowLongW, AdjustWindowRect, UpdateWindow
d3d11.dll	D3D11CreateDeviceAndSwapChain
gdiplus.dll	GdiplusStartup, GdiplusShutdown

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
08/03/21-03:32:01.658714	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49706	5656	192.168.2.3	185.244.30.22
08/03/21-03:32:07.884442	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49714	5656	192.168.2.3	185.244.30.22
08/03/21-03:32:13.096068	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49720	5656	192.168.2.3	185.244.30.22
08/03/21-03:32:20.053138	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49726	5656	192.168.2.3	185.244.30.22
08/03/21-03:32:26.158381	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49729	5656	192.168.2.3	185.244.30.22
08/03/21-03:32:35.527911	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49731	5656	192.168.2.3	185.244.30.22
08/03/21-03:32:41.635368	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49732	5656	192.168.2.3	185.244.30.22
08/03/21-03:32:48.089965	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49733	5656	192.168.2.3	185.244.30.22
08/03/21-03:32:56.068267	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49742	5656	192.168.2.3	185.244.30.22
08/03/21-03:33:02.446681	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49743	5656	192.168.2.3	185.244.30.22
08/03/21-03:33:08.692026	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49744	5656	192.168.2.3	185.244.30.22
08/03/21-03:33:14.889582	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49745	5656	192.168.2.3	185.244.30.22
08/03/21-03:33:21.077319	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49746	5656	192.168.2.3	185.244.30.22
08/03/21-03:33:27.201337	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49749	5656	192.168.2.3	185.244.30.22
08/03/21-03:33:33.527958	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49753	5656	192.168.2.3	185.244.30.22
08/03/21-03:33:40.158463	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49755	5656	192.168.2.3	185.244.30.22
08/03/21-03:33:46.612650	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49756	5656	192.168.2.3	185.244.30.22
08/03/21-03:33:52.859023	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49757	5656	192.168.2.3	185.244.30.22
08/03/21-03:33:58.969834	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49758	5656	192.168.2.3	185.244.30.22
08/03/21-03:34:04.972456	TCP	2025019	ET TROJAN Possible NanoCore C2 60B	49759	5656	192.168.2.3	185.244.30.22

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 3, 2021 03:31:50.874691963 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.874774933 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.885886908 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.885925055 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.885943890 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.886004925 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.886028051 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.886061907 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.886090040 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.886113882 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.886183977 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.886212111 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.886234045 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.886255980 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.886271000 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.886349916 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.886447906 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.897280931 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.897326946 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.897356033 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.897380114 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.897404909 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.897403955 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.897429943 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.897454023 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.897476912 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.897479057 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.897502899 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.897507906 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.897562981 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.897584915 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.897603035 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.897629023 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.897701979 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.897726059 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.897751093 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.897773981 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.897841930 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.897852898 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.897878885 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.897885084 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.897898912 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.897911072 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.897948027 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.898009062 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.898014069 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.898037910 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.898072004 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.898145914 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.898173094 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.898211956 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.910824060 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.910860062 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.910883904 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.910901070 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.910926104 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.910949945 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.910974979 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.910998106 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911031961 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911061049 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911083937 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911108017 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911204100 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911231995 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911259890 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911284924 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911309004 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911343098 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911372900 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911396980 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911422014 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911447048 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911480904 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.911484003 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911509037 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911534071 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911566973 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911567926 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:50.911597013 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911621094 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911645889 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911672115 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911694050 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911719084 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911744118 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911777973 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911806107 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911828995 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.911854982 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.966413021 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:50.966567993 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:55.852992058 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:55.853085995 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:55.853144884 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:55.853187084 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:55.853225946 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:55.853252888 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:55.853267908 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:55.853293896 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:55.853315115 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:55.853334904 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:55.864427090 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.864470959 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.864516973 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.864547014 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.864572048 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.864589930 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.864641905 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.864675045 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.864701986 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.864727020 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.864761114 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.864789963 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.864825010 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.864860058 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.864888906 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.864906073 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.864923954 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.864950895 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.864976883 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.865001917 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.865025043 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.865050077 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.865176916 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.865202904 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.865226030 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.865303993 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.865333080 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.865366936 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.865396023 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.865418911 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.865444899 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.865468979 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.865521908 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.865545034 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866184950 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866209984 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866344929 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866379976 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866408110 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866434097 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866460085 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866485119 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866512060 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866538048 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866560936 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866595030 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866625071 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866628885 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:55.866650105 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866677046 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866702080 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866725922 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866741896 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866766930 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866791010 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866816998 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866841078 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866868019 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866893053 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866921902 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:31:55.866928101 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.866957903 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.867430925 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.867460966 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.867542982 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.868036032 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.868072987 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.868103981 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.923331976 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:31:55.923475981 CEST	49696	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:32:01.511368990 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:01.613954067 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:01.614054918 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:01.658714056 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:01.813785076 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:01.813930035 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:01.972944975 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:01.973042965 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.013879061 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.055506945 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.126769066 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.126873970 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.230720043 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.230833054 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.393141031 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.393445969 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.555843115 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.555974960 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.634171963 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.634288073 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.641498089 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.641561985 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.642877102 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.642919064 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.642934084 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.642962933 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.643645048 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.643685102 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.643702984 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.643727064 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.644082069 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.644145012 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.644155979 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.644186974 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.644196033 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.644231081 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.718308926 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.741285086 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.741377115 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.741426945 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.742820024 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.742896080 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.745141983 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.745228052 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.746834040 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.746887922 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.748538971 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.748589039 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.749229908 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.749285936 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.749372005 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.749434948 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.750951052 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.751013041 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.757997990 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.758085012 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.759077072 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.759150982 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.760585070 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.760643959 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.761389971 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.761454105 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.762177944 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.762244940 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.849241018 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.849308968 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.850692987 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.850737095 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.850759029 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.856275082 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.856333971 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.862030983 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.862103939 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.863648891 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.863718033 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.865957975 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.866008043 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.873297930 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.873383999 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.874113083 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.874221087 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.952516079 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.952609062 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.952699900 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.960325003 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.960403919 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.962759018 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.962884903 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.971447945 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.971525908 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.974670887 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.974745035 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.977353096 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.977441072 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:02.981373072 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:02.981462002 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.058217049 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.058335066 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.059057951 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.059180975 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.059796095 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.067018032 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.067109108 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.067425013 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.067502022 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.073843002 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.073915958 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.179619074 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.179729939 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.179760933 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.287935972 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.288053036 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.288085938 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.288516998 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.288597107 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.288727045 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.288799047 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.339618921 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.395154953 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.395286083 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.395643950 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.395726919 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.396229982 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.396312952 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.420386076 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.420475006 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.421328068 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.421369076 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.421402931 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.421421051 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.421422958 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.421477079 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.422099113 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.422162056 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.422317982 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.422379971 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.509634018 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.524617910 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.524705887 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.526108980 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.526165962 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.526201010 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.526232004 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.529198885 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.529301882 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.529459000 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.529510021 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.529526949 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.529567003 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.529567003 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.529628038 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.537422895 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.537468910 CEST	5656	49706	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:03.537512064 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:03.537542105 CEST	49706	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:07.765177965 CEST	49714	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:07.883007050 CEST	5656	49714	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:07.883153915 CEST	49714	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:07.884442091 CEST	49714	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:07.997833967 CEST	5656	49714	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:08.025433064 CEST	49714	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:08.145190954 CEST	5656	49714	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:08.145332098 CEST	49714	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:08.213027000 CEST	49714	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:08.321225882 CEST	5656	49714	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:08.321418047 CEST	49714	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:12.931193113 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:13.060976028 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:13.061264992 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:13.096067905 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:13.244641066 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:13.248692989 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:13.460233927 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:13.509605885 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:13.955336094 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.062295914 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.062376976 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.290991068 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.291112900 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.697151899 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.793817997 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.793915987 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.795044899 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.795126915 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.795171022 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.795212984 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.795247078 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.795258999 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.795268059 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.795301914 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.795334101 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.795337915 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.795376062 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.795423031 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.795782089 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.795823097 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.795859098 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.795862913 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.795895100 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.795936108 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.871234894 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.871368885 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.925395966 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.926361084 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.926435947 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.927170992 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.927232027 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.928356886 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.928422928 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.930706024 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.930771112 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.931627989 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.931720972 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.932549953 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.932612896 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.933051109 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.933114052 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.934355974 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.934427977 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.935415983 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.935473919 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:14.936364889 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:14.936428070 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.032797098 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.032896042 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.041309118 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.041413069 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.042401075 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.042484999 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.044290066 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.044408083 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.045593977 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.045757055 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.068135023 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.068216085 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.068252087 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.068973064 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.069041967 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.070755959 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.070827007 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.129863977 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.129925013 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.129983902 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.130037069 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.185152054 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.185249090 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.187650919 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.187721968 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.188419104 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.188487053 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.189212084 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.189287901 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.189707994 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.189771891 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.200108051 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.200210094 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.200990915 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.201076031 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.213299990 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.265716076 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.265795946 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.266700029 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.266755104 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.323431015 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.323714972 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.323770046 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.326441050 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.326666117 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.327656031 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.327902079 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.328355074 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.328459024 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.418909073 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.418972015 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.419158936 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.419209957 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.419218063 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.425168991 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.511392117 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.511451960 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.511643887 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.513436079 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.513499975 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.513542891 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.513602018 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.513637066 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.513705015 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.513727903 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.513969898 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.514060020 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.532442093 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.532532930 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.532643080 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.532732964 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.617537022 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.617738962 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.620237112 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.620277882 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.620345116 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.621577024 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.621635914 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.624033928 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.624147892 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.624186039 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.624216080 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.624291897 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.624345064 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.635134935 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.644634962 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.644715071 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.645133018 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.645200014 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:15.950965881 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:15.951055050 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:16.005795956 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:16.005847931 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:16.005934000 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:16.005964994 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:16.006017923 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:16.006062031 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:16.006073952 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:16.006107092 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:16.047580004 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:16.047688007 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:16.060353994 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:16.060540915 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:16.060657978 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:16.060766935 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:16.061850071 CEST	5656	49720	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:16.061933994 CEST	49720	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:16.951024055 CEST	49694	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:16.951153040 CEST	49694	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:16.951785088 CEST	49723	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:16.975981951 CEST	443	49694	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:16.976017952 CEST	443	49694	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:16.976950884 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:16.977150917 CEST	49723	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:16.977478981 CEST	49723	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:17.003324986 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.003388882 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.003467083 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.003514051 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.003523111 CEST	49723	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:17.003551960 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.003626108 CEST	49723	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:17.015317917 CEST	49723	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:17.022825956 CEST	443	49694	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.041073084 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.042669058 CEST	49723	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:17.042725086 CEST	49723	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:17.067641020 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.067683935 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.083931923 CEST	443	49694	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.083993912 CEST	443	49694	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.084032059 CEST	443	49694	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.084069967 CEST	443	49694	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.084074974 CEST	49694	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:17.084108114 CEST	443	49694	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.084146023 CEST	443	49694	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.084181070 CEST	49694	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:17.084192991 CEST	443	49694	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.084234953 CEST	443	49694	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.084270000 CEST	443	49694	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.084284067 CEST	49694	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:17.084382057 CEST	49694	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:17.166733980 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.166786909 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.166824102 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.166862011 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.166898966 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.166914940 CEST	49723	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:17.166946888 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.166955948 CEST	49723	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:17.166990995 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.167007923 CEST	49723	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:17.167027950 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.167063951 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:32:17.167083979 CEST	49723	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:17.212946892 CEST	49723	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:32:19.946033955 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:20.051511049 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:20.051698923 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:20.053138018 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:20.214149952 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:20.214514017 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:20.454710960 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:20.454829931 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:20.729717970 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:20.733356953 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.150974989 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.225332975 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.225544930 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.350502968 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.350780964 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.526072979 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.526171923 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.594109058 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.594547987 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.594772100 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.599323988 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.599369049 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.599417925 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.599430084 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.599461079 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.599463940 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.599481106 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.599499941 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.599539995 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.599575996 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.713144064 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.713377953 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.713783979 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.713885069 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.714509010 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.715097904 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.715199947 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.716986895 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.717086077 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.717257977 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.717308044 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.717350006 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.717353106 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.717456102 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.717480898 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.807970047 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.860019922 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.860330105 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.865098953 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.865219116 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.888741016 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.888988972 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.928621054 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.928972960 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.972944975 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.973153114 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:21.975740910 CEST	5656	49726	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:21.975967884 CEST	49726	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:26.049663067 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:26.157587051 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:26.157756090 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:26.158380985 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:26.390760899 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:26.390862942 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:26.513789892 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:26.513895988 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:26.781932116 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:26.782219887 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:26.887022972 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:26.887327909 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.091551065 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.093930006 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.265938044 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.266074896 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.266310930 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.266403913 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.267391920 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.267514944 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.268243074 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.268330097 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.269089937 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.269129992 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.269198895 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.269247055 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.269957066 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.270049095 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.270175934 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.270268917 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.271452904 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.271565914 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.272161961 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.272243977 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.371648073 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.371786118 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.371813059 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.371895075 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.376221895 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.376636028 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.376741886 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.377783060 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.377878904 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.386049032 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.386814117 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.386924982 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.387717009 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.387809992 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.389168978 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.389240026 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.390069008 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.390135050 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.390671015 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.390727997 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.393726110 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.393776894 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.393812895 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.393821955 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.393851042 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.393858910 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.393882036 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.393896103 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.393933058 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.393942118 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.393959045 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.393969059 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.393985033 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.394033909 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.475828886 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.476030111 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.476053953 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.476505995 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.476571083 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.477005959 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.477200985 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.488607883 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.488692045 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.489239931 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.489311934 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.492419004 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.492516041 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.496666908 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.496769905 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.503767014 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.505913973 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.508435011 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.508560896 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.509171963 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.509263992 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.509980917 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.510071039 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.513958931 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.514079094 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.515367031 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.515475035 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.579552889 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.579699039 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.579731941 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.580745935 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.580841064 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.581913948 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.582003117 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.592377901 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.592479944 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.602698088 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.602865934 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.622409105 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.622473001 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.622514009 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.622550011 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.622560978 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.622586966 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.622618914 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.622623920 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.622637987 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.622740984 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.622812986 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.623012066 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.687673092 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.687863111 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.690849066 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.691088915 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.692286015 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.692446947 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.695672989 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.695774078 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.709732056 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.709994078 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.743531942 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.743856907 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.747391939 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.747554064 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.752577066 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.752784967 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.777282953 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.795491934 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.795768023 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.797085047 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.797281027 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.799633026 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.799829006 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.801033020 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.801208019 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.813159943 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.813325882 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.852116108 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.852273941 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.852305889 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.852963924 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.853116989 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.858536959 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.858694077 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.901055098 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.901320934 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.904335022 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.904405117 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.904512882 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.904581070 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.919517040 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.919683933 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.920363903 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.920486927 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.921051979 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.921165943 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.957035065 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.957180977 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.959448099 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.959573984 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.968300104 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:27.968426943 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:27.980360031 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:28.008481979 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:28.008599997 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:28.012641907 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:28.012749910 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:28.027945042 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:28.028018951 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:28.028395891 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:28.028458118 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:28.029293060 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:28.029381990 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:28.040762901 CEST	5656	49729	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:28.040859938 CEST	49729	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:32.406955957 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:35.417560101 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:35.526675940 CEST	5656	49731	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:35.526813984 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:35.527910948 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:35.681874037 CEST	5656	49731	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:35.681972027 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:35.837163925 CEST	5656	49731	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:35.837400913 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:35.906735897 CEST	5656	49731	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:35.948905945 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:36.230135918 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:36.337018013 CEST	5656	49731	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:36.667680979 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:36.773046017 CEST	5656	49731	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:36.773160934 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:36.773955107 CEST	5656	49731	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:36.823950052 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:37.136749983 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:37.302810907 CEST	5656	49731	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:37.302948952 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:37.324532032 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:37.432532072 CEST	5656	49731	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:37.432604074 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:37.432836056 CEST	5656	49731	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:37.432889938 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:37.432893991 CEST	5656	49731	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:37.432945967 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:37.433695078 CEST	5656	49731	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:37.433748007 CEST	5656	49731	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:37.433769941 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:37.433800936 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:37.436816931 CEST	5656	49731	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:37.436929941 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:37.437236071 CEST	5656	49731	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:37.437283993 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:37.437355995 CEST	5656	49731	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:37.437414885 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:37.437869072 CEST	5656	49731	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:37.437923908 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:37.437930107 CEST	5656	49731	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:37.437973976 CEST	49731	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:41.529052973 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:41.634049892 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:41.634233952 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:41.635368109 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:41.789961100 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:41.790121078 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:41.942048073 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:41.946312904 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.054630995 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.054975986 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.099436045 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.099615097 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.237277985 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.237495899 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.240295887 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.293239117 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.393213987 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.393552065 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.600785971 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.600920916 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.712697029 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.712781906 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.712940931 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.714474916 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.714544058 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.714595079 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.714735031 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.714771032 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.714833975 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.714900017 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.714937925 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.715008974 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.717058897 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.717133045 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.717206955 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.717257977 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.719194889 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.719312906 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.783381939 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.783622980 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.845215082 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.845289946 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.845469952 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.846754074 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.846834898 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.846885920 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.846931934 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.846970081 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.846997976 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.847039938 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.847095966 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.847629070 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.847692966 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.847734928 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.847779989 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.853821993 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.853885889 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.853954077 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.853991032 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.854074001 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.854176998 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.854650974 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.854717970 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.854754925 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.854821920 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.854881048 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.854980946 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.856164932 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.856234074 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.856303930 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.856332064 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.858519077 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.858581066 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.858640909 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.858700991 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.937073946 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.937355042 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.955259085 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.955423117 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.956554890 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.956621885 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.956712961 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.956722021 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.956775904 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.971292973 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.971401930 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.972544909 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.972665071 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.973607063 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.973664045 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.975229025 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.975296974 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.975305080 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.975356102 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.976681948 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.976748943 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.976752043 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.976807117 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.977999926 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.978065014 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.981056929 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.981096983 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.981132984 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.981165886 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.981620073 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.981681108 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.982603073 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.982664108 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.983427048 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.983496904 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.984699011 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.984778881 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.985615969 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.985680103 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.986536026 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.986593962 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.988183975 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.988217115 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.988255024 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.988269091 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.989443064 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.989480019 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.989507914 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.989527941 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.991219997 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.991302013 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.992927074 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.993103027 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.993726015 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.993774891 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:42.993803978 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:42.993856907 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.009998083 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.010094881 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.010276079 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.061693907 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.061871052 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.061919928 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.062026978 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.062154055 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.081960917 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.082062960 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.082143068 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.082217932 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.083173990 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.083271027 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.085103035 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.085180044 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.085211039 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.085266113 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.120807886 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.120939016 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.121118069 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.121243954 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.123053074 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.123147011 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.171967983 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.172168970 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.173418045 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.173609972 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.178419113 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.178539991 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.179033995 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.179141045 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.319593906 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.319897890 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.319950104 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.352436066 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.352499008 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.352571011 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.352617979 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.352642059 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.352700949 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.352719069 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.352737904 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.352792025 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.352859020 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.352941990 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.354087114 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.354204893 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.450221062 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.450510025 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.450561047 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.466101885 CEST	80	49680	93.184.220.29	192.168.2.3
Aug 3, 2021 03:32:43.466361046 CEST	49680	80	192.168.2.3	93.184.220.29
Aug 3, 2021 03:32:43.528702974 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.567641020 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.567728043 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.567775011 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.567821980 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:43.572504044 CEST	5656	49732	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:43.572618008 CEST	49732	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:44.184704065 CEST	49684	80	192.168.2.3	23.203.69.124
Aug 3, 2021 03:32:44.184891939 CEST	49685	443	192.168.2.3	23.203.67.116
Aug 3, 2021 03:32:44.201946974 CEST	443	49685	23.203.67.116	192.168.2.3
Aug 3, 2021 03:32:44.201982021 CEST	443	49685	23.203.67.116	192.168.2.3
Aug 3, 2021 03:32:44.202059031 CEST	49685	443	192.168.2.3	23.203.67.116
Aug 3, 2021 03:32:44.202147961 CEST	80	49684	23.203.69.124	192.168.2.3
Aug 3, 2021 03:32:44.202151060 CEST	49685	443	192.168.2.3	23.203.67.116
Aug 3, 2021 03:32:44.202240944 CEST	49684	80	192.168.2.3	23.203.69.124
Aug 3, 2021 03:32:44.794151068 CEST	49689	80	192.168.2.3	173.222.108.226
Aug 3, 2021 03:32:44.794251919 CEST	49690	80	192.168.2.3	173.222.108.226
Aug 3, 2021 03:32:44.794425964 CEST	49691	80	192.168.2.3	173.222.108.226
Aug 3, 2021 03:32:44.811088085 CEST	80	49690	173.222.108.226	192.168.2.3
Aug 3, 2021 03:32:44.811220884 CEST	49690	80	192.168.2.3	173.222.108.226
Aug 3, 2021 03:32:44.811291933 CEST	80	49689	173.222.108.226	192.168.2.3
Aug 3, 2021 03:32:44.811337948 CEST	80	49691	173.222.108.226	192.168.2.3
Aug 3, 2021 03:32:44.811444044 CEST	49689	80	192.168.2.3	173.222.108.226
Aug 3, 2021 03:32:44.811513901 CEST	49691	80	192.168.2.3	173.222.108.226
Aug 3, 2021 03:32:45.486447096 CEST	49692	443	192.168.2.3	23.211.5.146
Aug 3, 2021 03:32:45.486498117 CEST	49693	80	192.168.2.3	93.184.220.29
Aug 3, 2021 03:32:45.818474054 CEST	80	49688	93.184.220.29	192.168.2.3
Aug 3, 2021 03:32:45.818712950 CEST	49688	80	192.168.2.3	93.184.220.29
Aug 3, 2021 03:32:46.822988987 CEST	80	49698	93.184.220.29	192.168.2.3
Aug 3, 2021 03:32:46.823271036 CEST	49698	80	192.168.2.3	93.184.220.29
Aug 3, 2021 03:32:47.235688925 CEST	49700	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:32:47.236231089 CEST	49701	443	192.168.2.3	204.79.197.200
Aug 3, 2021 03:32:47.978382111 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:48.089114904 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:48.089421988 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:48.089965105 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:48.260344028 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:48.261004925 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:48.378802061 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:48.378922939 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:48.543390036 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:48.543471098 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:48.648834944 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:48.648973942 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:48.807104111 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:48.809492111 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:48.975203037 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:48.991688967 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:48.997544050 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:48.997612953 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:48.998419046 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:48.998560905 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:48.998624086 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:48.999459982 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.000205994 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.000230074 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.000288010 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.000973940 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.001035929 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.001512051 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.001576900 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.003674984 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.103537083 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.103617907 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.104309082 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.104392052 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.112824917 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.112906933 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.112957001 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.112974882 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.113004923 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.113013029 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.113058090 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.122453928 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.123481035 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.123569965 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.123588085 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.123621941 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.125185966 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.125236034 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.125272036 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.125286102 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.125426054 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.125755072 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.131458044 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.131503105 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.131541967 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.131588936 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.131588936 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.131606102 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.131623983 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.131645918 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.131661892 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.131671906 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.131699085 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.131747961 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.210839987 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.213840961 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.218270063 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.218327999 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.218369961 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.231996059 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.232045889 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.232130051 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.233133078 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.233179092 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.233211994 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.236237049 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.236968994 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.237034082 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.237059116 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.237117052 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.239970922 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.243746042 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.260888100 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.260976076 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.267339945 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.267507076 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.318342924 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.318443060 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.318655014 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.323486090 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.323575974 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.342278004 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.342394114 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.348782063 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.348895073 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.357808113 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.357867956 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.360939026 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.361030102 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.361803055 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.361845970 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.361901999 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.361915112 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.362817049 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.362879992 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.368092060 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.371011972 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.386892080 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.386957884 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.434195042 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.434240103 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.434350967 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.450248003 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.455739021 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.463535070 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.467780113 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.486701965 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.487401962 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.487509966 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.487577915 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.487803936 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.487884045 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.488543034 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.488615990 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.489321947 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.489398003 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.494230986 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.494306087 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.561049938 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.561157942 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.567343950 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.567420959 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.567485094 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.573340893 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.574181080 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.574270010 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.612783909 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.612814903 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.612874031 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.613142014 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.613205910 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.615272999 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.617892027 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.620546103 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.620630980 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.692167997 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.695770025 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.695823908 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.695831060 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.695849895 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.695883036 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.695885897 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.695935965 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.695945978 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.695980072 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.727472067 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.727535009 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.727680922 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.728661060 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.728759050 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.729482889 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.729556084 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.729754925 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.729830027 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.799439907 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.812056065 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.812118053 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.812160015 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.812208891 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.812247992 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.812279940 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.836972952 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.839868069 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.850622892 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.851350069 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.851483107 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.853071928 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.854861021 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.922019958 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.922080994 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.922226906 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.922588110 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.922662020 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.924019098 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.924060106 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.924144983 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.965158939 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.965938091 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.971256018 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:49.971343994 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:49.971581936 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.012532949 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.043178082 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.043797970 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.044954062 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.044995070 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.045084000 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.046869040 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.087008953 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.087069988 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.087111950 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.087172031 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.087228060 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.087260962 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.131463051 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.133928061 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.150727034 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.151457071 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.151555061 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.162552118 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.163826942 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.168226004 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.168807030 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.209527969 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.209681988 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.209758997 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.209779978 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.212291002 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.259279013 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.259816885 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.271083117 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.291145086 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.294051886 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.317967892 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.319946051 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.326019049 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.326066017 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.326196909 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.330720901 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.330843925 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.330889940 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.372046947 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.372796059 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.372941971 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.416279078 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.418946028 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.425118923 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.427867889 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.442435980 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.442909002 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.443442106 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.443515062 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.448107958 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.448584080 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.448649883 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.448723078 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.448740005 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.482741117 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.483057022 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.527200937 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.531220913 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.534811974 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.534925938 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.551193953 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.551276922 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.552340984 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.553036928 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.566108942 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.566160917 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.567522049 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.567596912 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.568464994 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.568563938 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.569889069 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.570383072 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.597023964 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.597089052 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.598683119 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.598748922 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.642827988 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.642910957 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.643713951 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.653640032 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.658328056 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.658432007 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.679682970 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.679830074 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.680099010 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.680160999 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.680263042 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.680414915 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.716423988 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.716500998 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.718884945 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.749864101 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.749958038 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.760637045 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.760740995 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.766657114 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.766741991 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.792567015 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.792690039 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.797810078 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.797868013 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.797874928 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.797924995 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.826997042 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.827075958 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.860697985 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.860781908 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.872299910 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.876420021 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.876532078 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.878758907 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.878838062 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.879023075 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.879085064 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.898160934 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.898243904 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.928352118 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.928431034 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.935730934 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.935853004 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.988781929 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.988888025 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.988922119 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.990669012 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.990725040 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:50.999640942 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:50.999718904 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:51.009040117 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:51.009159088 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:51.009998083 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:51.010071993 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:51.040299892 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:51.040381908 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:51.110970974 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:51.111066103 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:51.111291885 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:51.111372948 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:51.111392021 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:51.169675112 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:51.177166939 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:51.177253962 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:51.215476036 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:51.215538979 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:51.215555906 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:51.215585947 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:51.314954996 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:51.315042973 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:51.315263987 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:51.315383911 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:51.315546989 CEST	5656	49733	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:51.315593004 CEST	49733	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:55.420423031 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:56.067557096 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:56.067807913 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:56.068267107 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:56.227586031 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:56.228302002 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:56.384900093 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:56.385009050 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:56.467472076 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:56.467622042 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:56.553539038 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:56.553658009 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:56.634042978 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:56.634196043 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:56.657946110 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:56.700589895 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:56.788239002 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:56.788347006 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:56.940773010 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:56.943016052 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:56.962007046 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:56.962538004 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:56.962636948 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:56.962790966 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:56.963469028 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:56.963510990 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:56.963591099 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:56.964317083 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:56.964668036 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:56.965775013 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:56.965856075 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:56.966892004 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:56.968355894 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:56.972330093 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.070422888 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.070446014 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.070524931 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.084522963 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.084600925 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.084620953 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.088027954 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.088346004 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.088923931 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.088939905 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.088989019 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.089016914 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.089715004 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.089770079 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.089833021 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.093612909 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.093643904 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.093667030 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.093696117 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.093705893 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.093730927 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.095021963 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.095094919 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.095911026 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.095979929 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.100033045 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.100353003 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.141848087 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.183096886 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.184420109 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.193754911 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.194057941 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.198487997 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.198604107 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.199322939 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.199398041 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.200182915 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.200315952 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.200403929 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.200439930 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.201301098 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.201881886 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.202019930 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.204608917 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.204690933 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.206679106 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.206758976 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.219165087 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.295865059 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.296046019 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.296092033 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.306349039 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.307701111 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.307811022 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.314053059 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.314485073 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.314522982 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.314559937 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.314673901 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.314707994 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.314713955 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.322670937 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.324570894 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.372980118 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.402075052 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.402196884 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.411223888 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.411309004 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.418037891 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.418715000 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.419599056 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.419759989 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.419985056 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.420320034 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.420413971 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.420608997 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.420707941 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.421839952 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.424447060 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.427272081 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.427443981 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.432341099 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.432529926 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.506562948 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.506722927 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.525180101 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.526933908 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.549288988 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.549412966 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.549854994 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.549951077 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.552881956 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.552925110 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.552973986 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.553018093 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.555376053 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.555504084 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.562413931 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.563138008 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:57.563235044 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:57.967153072 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:58.102763891 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:58.102818966 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:58.102854967 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:58.102982998 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:58.103090048 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:58.170013905 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:58.170181990 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:58.175641060 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:58.175787926 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:58.176395893 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:58.176492929 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:58.179723978 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:58.179763079 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:58.179810047 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:58.179838896 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:58.179860115 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:58.179970026 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:32:58.186697960 CEST	5656	49742	185.244.30.22	192.168.2.3
Aug 3, 2021 03:32:58.186906099 CEST	49742	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:02.186403036 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:02.445395947 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:02.445521116 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:02.446681023 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:02.696990967 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:02.697073936 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:02.801150084 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:02.801353931 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:02.870472908 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:02.870718002 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:02.967314959 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.027434111 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.027646065 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.193232059 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.193347931 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.347527027 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.347688913 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.399468899 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.399687052 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.426892042 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.426961899 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.427112103 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.427623987 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.427742958 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.431320906 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.431365013 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.431421041 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.431474924 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.431480885 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.431596041 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.432693958 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.432755947 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.432797909 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.432905912 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.504813910 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.540405035 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.540445089 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.540555000 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.540596008 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.558043003 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.558212042 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.569679976 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.570749044 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.573000908 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.585303068 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.588974953 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.636013985 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.636246920 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.636318922 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.658545017 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.658603907 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.658664942 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.658725023 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.658782005 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.658808947 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.658837080 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.658890963 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.658916950 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.658942938 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.658986092 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.658998013 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.659050941 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.659055948 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.659102917 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.659195900 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.659199953 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.659271002 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.659363031 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.660023928 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.660146952 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.662897110 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.662945032 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.663006067 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.663058043 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.672219038 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.672398090 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.672493935 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.672967911 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.705121994 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.705178976 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.705319881 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.705425978 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.705586910 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.742558956 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.742623091 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.742651939 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.743659019 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.743710995 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.744805098 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.744882107 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.766383886 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.766469955 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.767499924 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.767566919 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.768516064 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.768925905 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.769346952 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.769531965 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.769885063 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.769963026 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.770581961 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.770699978 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.770812988 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.770955086 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.776139975 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.776160002 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.776931047 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.777107000 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.792614937 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.792707920 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.792795897 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.792876005 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.841428041 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.841490984 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.841660976 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.841911077 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.856093884 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.856259108 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.859730959 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.859833956 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.859894037 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.859983921 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.861084938 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.861161947 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.880319118 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.880481958 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.880898952 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.881153107 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.881161928 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.881290913 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.882359028 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.882520914 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.883277893 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.883400917 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.890736103 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.890930891 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.903074026 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.903352022 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.911053896 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.911211014 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.911569118 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.911736012 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.950658083 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.950748920 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.960290909 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.960351944 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.963443041 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.963510990 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.967266083 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:03.967462063 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:03.967547894 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.005414963 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.005578995 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.076235056 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.076446056 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.076925993 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.085521936 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.085656881 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.113713026 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.113826036 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.170032978 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.170248985 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.171288013 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.171431065 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.173026085 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.173156023 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.173491955 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.173593998 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.176933050 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.177040100 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.187453032 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.187607050 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.210511923 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.210751057 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.239631891 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.241317987 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.241496086 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.251638889 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.251823902 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.251836061 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.251977921 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.255460024 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.255587101 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.295361996 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.295470953 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.311397076 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.311592102 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.311678886 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.324873924 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.324965000 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.346477032 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.346577883 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.355878115 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.355994940 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.357666016 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.357762098 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.364717960 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.364911079 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.364973068 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.365056992 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.365274906 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.365365028 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.368922949 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.369009972 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.387962103 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.388029099 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.388076067 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.388084888 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.388094902 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.388159990 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:04.425048113 CEST	5656	49743	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:04.425230026 CEST	49743	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:08.586128950 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:08.689836979 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:08.690053940 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:08.692025900 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:08.843908072 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:08.844136000 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:08.947515965 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:08.993802071 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:08.995992899 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.101108074 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.101432085 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.258569002 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.258836031 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.416914940 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.417143106 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.487912893 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.488044024 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.489070892 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.489275932 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.489293098 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.489372969 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.489428043 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.489444017 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.489464045 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.489557028 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.489577055 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.489638090 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.489645958 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.489650011 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.489701033 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.489763021 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.593010902 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.593236923 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.633280039 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.633476019 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.633528948 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.633563995 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.633594990 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.633635044 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.633649111 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.633670092 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.633707047 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.633738995 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.633770943 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.633861065 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.633915901 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.633922100 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.634248018 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.634347916 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.635179996 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.635267019 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.644633055 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.644695044 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.644750118 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.644810915 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.644901037 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.660526037 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.660695076 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.661217928 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.661354065 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.662316084 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.662398100 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.662434101 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.662512064 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.663280010 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.663381100 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.737313032 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.737476110 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.737987041 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.738106966 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.738853931 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.738954067 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.739377022 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.739430904 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.739475012 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.739522934 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.757580042 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.760785103 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.778227091 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.779318094 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.779409885 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.780926943 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.781014919 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.782546997 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.782651901 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.786839962 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.786906004 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.787383080 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.787527084 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.787554979 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.787610054 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.787636042 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.787657976 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.787682056 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.787705898 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.787729979 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.787734985 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.787749052 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.787763119 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.787781954 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.787796021 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.787806034 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.787832975 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.787847042 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.787862062 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.787902117 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.788204908 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.788270950 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.795289993 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.795382977 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.801737070 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.801863909 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.801873922 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.801954031 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.801981926 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.802040100 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.802485943 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.802555084 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.803520918 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.803548098 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.803584099 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.803608894 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.803617001 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.803631067 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.803672075 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.848778963 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.848864079 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.849390984 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.884154081 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.884236097 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.884912968 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.884972095 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.887326956 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.887422085 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.888230085 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.888282061 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.890043974 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.890094995 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.890146017 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.890182018 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.899491072 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.899631023 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.899955034 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.900021076 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.907426119 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.907599926 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.908169985 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.908240080 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.908243895 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.908303976 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.908915997 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.909022093 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.909116030 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.909209013 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.909210920 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.909271002 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.909717083 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.909801960 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.916208029 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.916347980 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.920944929 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.921087980 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.921660900 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.921741009 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.922030926 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.922101021 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.923042059 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.923125029 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.923255920 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.923346043 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.991559029 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.991832972 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.991883039 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:09.993144035 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:09.993396997 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.005281925 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.005458117 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.017927885 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.018035889 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.023422003 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.023552895 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.023734093 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.023786068 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.023833036 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.023834944 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.023875952 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.023912907 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.023973942 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.025154114 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.025450945 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.035181999 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.035830021 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.041332006 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.041477919 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.041572094 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.041769981 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.043538094 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.043667078 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.048787117 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.048954010 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.048990011 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.128196001 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.128407001 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.205427885 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.205578089 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.315325975 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.315515041 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.315557003 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.421863079 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.422007084 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.422352076 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.422450066 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.424834013 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.424855947 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.424935102 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.425007105 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.425278902 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.430521011 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.430634022 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.431320906 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.431432009 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.433078051 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.433105946 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.433176994 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.472054005 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.514868975 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.531593084 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.531704903 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.532524109 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.532650948 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.532929897 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.533000946 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.533500910 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.533591032 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.604793072 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.604825974 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.604847908 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.604866028 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.604918003 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.604944944 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.604949951 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.604953051 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.604959965 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.605010033 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.605011940 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.605312109 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.606770992 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.606794119 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.606852055 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.606851101 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.606885910 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.606904030 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.606905937 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.606981993 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.607474089 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.607495070 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.607528925 CEST	5656	49744	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:10.607583046 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.607621908 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:10.607629061 CEST	49744	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:14.783232927 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:14.887981892 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:14.888196945 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:14.889581919 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:15.059920073 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:15.060142040 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:15.221513033 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:15.221791029 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:15.336225033 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:15.336529970 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:15.417237043 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:15.417498112 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:15.607877016 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:15.608082056 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:15.673614979 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:15.673980951 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:15.963093996 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:15.963195086 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.035837889 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.206396103 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.206501961 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.248081923 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.248157024 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.248708963 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.248756886 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.248778105 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.248814106 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.248816013 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.248867989 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.248871088 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.248924017 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.248927116 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.248979092 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.249025106 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.249028921 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.249064922 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.249089003 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.249092102 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.249144077 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.249145031 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.249217987 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.443269968 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.443387985 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.443571091 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.443689108 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.444396973 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.444524050 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.451822042 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.451947927 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.451946974 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.452050924 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.452068090 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.452143908 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.452231884 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.452241898 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.452291012 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.452344894 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.452368021 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.452431917 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.452446938 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.452513933 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.452519894 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.452583075 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.452585936 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.452626944 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.452653885 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.452703953 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.452725887 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.452792883 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.452807903 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.452848911 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.452903032 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.452930927 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.452991962 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.453027964 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.453047991 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.453166962 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.453178883 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.551158905 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.551337957 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.551384926 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.553002119 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.553071022 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.553117037 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.553164959 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.554977894 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.555042028 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.555094957 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.555164099 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.564809084 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.564914942 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.565809965 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.565908909 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.566920042 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.567044973 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.567173958 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.567267895 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.568032980 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.568134069 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.569084883 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.569186926 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.570034981 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.570130110 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.570921898 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.571027040 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.571033001 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.571108103 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.588136911 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.588181019 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.588246107 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.588315010 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.596028090 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.596070051 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.596107006 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.596117020 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.596136093 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.596158028 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.596185923 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.596195936 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.596229076 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.596235037 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.596254110 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.596271992 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.596291065 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.596318960 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.656172037 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.656425953 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.658222914 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.658473969 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.660645008 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.660832882 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.671435118 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.675287962 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.675324917 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.675414085 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.675504923 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.680510998 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.680603027 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.691292048 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.691400051 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.691623926 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.691688061 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.698127985 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.698285103 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.702137947 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.702243090 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.733387947 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.733447075 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.733486891 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.733525038 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.733562946 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.733609915 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.733649015 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.733733892 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.762185097 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.762437105 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.763279915 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.763406038 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.766339064 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.766504049 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:16.769596100 CEST	5656	49745	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:16.769701004 CEST	49745	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:20.967477083 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:21.075741053 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:21.075901031 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:21.077318907 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:21.368254900 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:21.368511915 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:21.468936920 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:21.469042063 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:21.524543047 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:21.524668932 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:21.644179106 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:21.644252062 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:21.672148943 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:21.672230005 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:22.077625036 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:22.193975925 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:22.194627047 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:22.302057028 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:22.302109003 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:22.302145958 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:22.302176952 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:22.302182913 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:22.302206039 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:22.302212954 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:22.302221060 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:22.302290916 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:22.309724092 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:22.309771061 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:22.309820890 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:22.309839964 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:22.309865952 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:22.309880972 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:22.309930086 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:22.515327930 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:22.874661922 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:22.891215086 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:23.180362940 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:23.180531025 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:23.180907965 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:23.180998087 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:23.181629896 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:23.181662083 CEST	5656	49746	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:23.181716919 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:23.181794882 CEST	49746	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:27.094186068 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:27.200700998 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:27.200822115 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:27.201337099 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:27.347067118 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:27.347209930 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:27.504297018 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:27.504371881 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:27.524872065 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:27.578062057 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:27.657743931 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:27.657830954 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:27.761746883 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:27.763041973 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:27.929961920 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:27.930989027 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.007525921 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.007698059 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.008984089 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.009026051 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.009072065 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.009114027 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.009149075 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.009179115 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.023561001 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.023611069 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.023648977 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.023746967 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.023812056 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.024466991 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.132301092 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.133954048 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.134011030 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.134136915 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.134953022 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.135474920 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.138997078 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.171418905 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.172394037 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.172892094 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.174998999 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.175498009 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.176598072 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.176676989 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.179445028 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.181121111 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.182996988 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.183177948 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.186995029 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.197647095 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.199105024 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.251044035 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.251126051 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.281910896 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.282017946 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.282675028 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.282988071 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.284848928 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.285510063 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.301518917 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.301759958 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.301780939 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.302897930 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.303003073 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.304301977 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.304387093 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.304670095 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.304759026 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.311369896 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.315023899 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.364212036 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.364562035 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.366483927 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.366554022 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.395411015 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.395649910 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.396039963 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.396131992 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.398993969 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.407075882 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.408859968 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.415409088 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.419049025 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.422539949 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.422702074 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.422736883 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.469113111 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.471174002 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.476336956 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.478389025 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.511576891 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.511678934 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.516434908 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.516606092 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.520977020 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.523030043 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.524142027 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.524321079 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.524401903 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.527378082 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.531039000 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.531263113 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.535032988 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.564172029 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.581099987 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.581641912 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.583059072 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.585180044 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.605096102 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.605214119 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.617990017 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.618185997 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.620201111 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.620280027 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.625722885 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.625850916 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.638632059 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.638699055 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.640770912 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.641158104 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.644107103 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.644172907 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.688241959 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.688359022 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.693001986 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.693088055 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.709887028 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.709979057 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.723474026 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.723570108 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.726217031 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.726332903 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.731828928 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.731915951 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.743911028 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.744080067 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.747292042 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.747384071 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.750657082 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.750770092 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.792232037 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.792346001 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.792365074 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.796854973 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.797055006 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.813882113 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.815073013 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.827537060 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.828768969 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.830796957 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.831047058 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.832123995 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.832207918 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.840399981 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.840544939 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.848512888 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.848644972 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.850920916 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.851011038 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.854722977 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.854804039 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.896639109 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.896723986 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.907406092 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.907495022 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.922619104 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.941334963 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.941394091 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.941502094 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.942131042 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.942197084 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.943480015 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:28.943547964 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:28.999958038 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:29.000073910 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.000099897 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.000569105 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:29.000629902 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.001841068 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:29.001899958 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.050525904 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:29.050622940 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.052366972 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:29.052462101 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.058397055 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:29.058475971 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.059310913 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:29.059370041 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.064970016 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:29.065078974 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.065623999 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:29.065680981 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.157131910 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.256576061 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:29.256763935 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.263972998 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:29.264064074 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.305145979 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:29.305202961 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:29.305362940 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.305377007 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.305394888 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:29.305442095 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.305496931 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:29.305543900 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.305706978 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:29.305754900 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.335742950 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:29.335820913 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:29.345845938 CEST	5656	49749	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:29.345958948 CEST	49749	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:32.938416004 CEST	49680	80	192.168.2.3	93.184.220.29
Aug 3, 2021 03:33:32.938421011 CEST	49688	80	192.168.2.3	93.184.220.29
Aug 3, 2021 03:33:32.938549042 CEST	49687	80	192.168.2.3	173.222.108.226
Aug 3, 2021 03:33:32.938575983 CEST	49686	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:33:32.955157042 CEST	80	49688	93.184.220.29	192.168.2.3
Aug 3, 2021 03:33:32.955179930 CEST	80	49680	93.184.220.29	192.168.2.3
Aug 3, 2021 03:33:32.955327988 CEST	49688	80	192.168.2.3	93.184.220.29
Aug 3, 2021 03:33:32.955406904 CEST	49680	80	192.168.2.3	93.184.220.29
Aug 3, 2021 03:33:32.955583096 CEST	80	49687	173.222.108.226	192.168.2.3
Aug 3, 2021 03:33:32.955858946 CEST	49687	80	192.168.2.3	173.222.108.226
Aug 3, 2021 03:33:32.963459015 CEST	443	49686	20.190.160.71	192.168.2.3
Aug 3, 2021 03:33:32.966242075 CEST	49686	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:33:32.986282110 CEST	49694	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:33:32.986339092 CEST	49723	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:33:33.011075020 CEST	443	49694	20.190.160.71	192.168.2.3
Aug 3, 2021 03:33:33.011106968 CEST	443	49723	20.190.160.71	192.168.2.3
Aug 3, 2021 03:33:33.011172056 CEST	49694	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:33:33.011369944 CEST	49723	443	192.168.2.3	20.190.160.71
Aug 3, 2021 03:33:33.422586918 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:33.526474953 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:33.527494907 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:33.527957916 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:33.688991070 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:33.689086914 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:33.844836950 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:33.845042944 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:33.930083990 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:33.984831095 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.001060009 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.001184940 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.110920906 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.111007929 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.265672922 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.265806913 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.420226097 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.420329094 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.530740023 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.530883074 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.530963898 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.531018972 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.532973051 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.533078909 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.552000999 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.552146912 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.552473068 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.552509069 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.552551985 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.552577019 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.552660942 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.552716017 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.552730083 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.552786112 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.552798986 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.552839041 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.645853996 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.645952940 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.646173954 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.646501064 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.646567106 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.647216082 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.647254944 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.647280931 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.647304058 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.659347057 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.659447908 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.661812067 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.661901951 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.664804935 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.664902925 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.669765949 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.669817924 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.669857979 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.669873953 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.751359940 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.751480103 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.751502991 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.751857996 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.751914978 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.752712011 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.752897978 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.752959967 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.752969980 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.765470982 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.765564919 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.767803907 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.767956018 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.768651962 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.768733025 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.773721933 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.773828030 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.774398088 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.775331020 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.856851101 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.857639074 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.857896090 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.857990980 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.858009100 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.872643948 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.872735023 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.875591993 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.876785040 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.877695084 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.877737045 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.877810955 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.877827883 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.968112946 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.968211889 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.969779015 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.969858885 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.969912052 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.970056057 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.981816053 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.981906891 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.984930992 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.985789061 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.985882044 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.985896111 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.985968113 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:34.987232924 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:34.988046885 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.075345039 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.075615883 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.075856924 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.076137066 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.076802969 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.076894045 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.077033997 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.077097893 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.077181101 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.088231087 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.088326931 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.094166040 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.095285892 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.096481085 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.099636078 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.138233900 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.179265976 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.179353952 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.183686018 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.184981108 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.187237978 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.187463045 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.188376904 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.189551115 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.189681053 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.189882994 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.193049908 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.193144083 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.200050116 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.202986956 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.203084946 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.283277035 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.283425093 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.284759998 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.287605047 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.291543961 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.294565916 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.294672012 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.296147108 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.296210051 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.298664093 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.298768997 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.298826933 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.306710005 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.306902885 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.394489050 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.395251036 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.395349026 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.402915955 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.403599977 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.405560970 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.405642033 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.405818939 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.405927896 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.406791925 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.406876087 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.407185078 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.407247066 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.414562941 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.415594101 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.416198969 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.416281939 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.500842094 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.500945091 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.506724119 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.506829023 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.510303020 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.510406017 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.511096001 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.511324883 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.514498949 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.514579058 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.515221119 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.515324116 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.519486904 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.519601107 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.520319939 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.520397902 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.527762890 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.613766909 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.615147114 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.621324062 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.621347904 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.621416092 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.621439934 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.621449947 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.621504068 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.633740902 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.633758068 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.633831978 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.633868933 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.634531021 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.634754896 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.634830952 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.634855032 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.639262915 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.639347076 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.641745090 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.697570086 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.697665930 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.722364902 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.722460032 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.735944986 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.736030102 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.736663103 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.736829996 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.736911058 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.755517960 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.755568027 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.755645990 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.756071091 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.756850958 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.756923914 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.756962061 CEST	5656	49753	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:35.757004023 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:35.757028103 CEST	49753	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:40.036881924 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:40.156840086 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:40.157963991 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:40.158463001 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:40.413454056 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:40.416018009 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:40.569772959 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:40.569880009 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:40.719238997 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:40.720011950 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:40.752751112 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:40.825730085 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:40.828090906 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:40.999061108 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:40.999178886 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.335961103 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.336076021 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.443970919 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.444132090 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.444257021 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.444360971 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.444679976 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.444757938 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.445545912 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.445651054 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.445660114 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.445724964 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.446552992 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.446640968 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.447005987 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.447084904 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.447101116 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.447191000 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.447889090 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.447968960 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.448136091 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.448215008 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.630215883 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.630367041 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.630408049 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.630789995 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.630844116 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.630883932 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.630911112 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.631089926 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.631181002 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.631211042 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.631236076 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.631285906 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.631320953 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.631333113 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.631341934 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.631347895 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.631426096 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.631432056 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.631470919 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.631496906 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.631527901 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.631541967 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.631577969 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.631594896 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.631639004 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.631901026 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.631982088 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.634074926 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.634145021 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.750169992 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.750260115 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.750477076 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.764317036 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.764425993 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.764869928 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.764911890 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.764928102 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.764946938 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.764954090 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.764964104 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.765014887 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.765227079 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.765295982 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.765474081 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.765539885 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.765856981 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.765944004 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.766510010 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.766587973 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.767016888 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.767100096 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.767225981 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.767296076 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.768197060 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.768265963 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.768485069 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.768554926 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.847737074 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.847842932 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:41.971245050 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:41.972151995 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:42.054558039 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.054676056 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:42.066776991 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.067601919 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:42.068908930 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.069000006 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:42.069189072 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.069324970 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:42.069922924 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.069989920 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:42.070235968 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.070322037 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.070440054 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:42.070491076 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:42.071187973 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.071269989 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:42.072099924 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.072154045 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.072169065 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:42.072211981 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.072274923 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:42.072884083 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.072964907 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:42.142278910 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:42.245327950 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.246570110 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.246660948 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:42.253679991 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.254486084 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.254559040 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:42.254944086 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.254987955 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.255074978 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:42.255249023 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.255299091 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.255336046 CEST	5656	49755	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:42.255358934 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:42.255381107 CEST	49755	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:46.504498959 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:46.611057043 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:46.611561060 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:46.612649918 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:46.770689964 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:46.770911932 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:46.928919077 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:46.929239035 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:46.980071068 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.032826900 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.081724882 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.081875086 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.188101053 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.188218117 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.345134020 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.345623970 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.494494915 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.494611979 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.537045002 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.537079096 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.537101030 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.537125111 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.537179947 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.537287951 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.553828955 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.553862095 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.553916931 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.553951979 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.554064989 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.554167986 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.554523945 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.554589033 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.554647923 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.554682016 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.554709911 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.554727077 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.655472994 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.655616045 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.655891895 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.655957937 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.666332960 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.666423082 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.666524887 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.666563034 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.667362928 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.667438030 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.667543888 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.667617083 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.675921917 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.675949097 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.675993919 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.676038027 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.680912971 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.680939913 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.680960894 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.680979013 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.681036949 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.681061983 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.681067944 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.682966948 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.682986021 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.683007956 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.683073044 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.683177948 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.683219910 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.683226109 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.683233023 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.683247089 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.683290958 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.683319092 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.768938065 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.769047976 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.769687891 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.769814968 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.772955894 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.772984982 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.773040056 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.773063898 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.778646946 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.778677940 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.778742075 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.778786898 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.779417992 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.779479980 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.787564039 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.787650108 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.790807962 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.790838003 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.790900946 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.790945053 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.791224003 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.791243076 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.791297913 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.791321039 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.791322947 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.791347980 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.791373968 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.791434050 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.797308922 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.797390938 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.798508883 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.798573971 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.798746109 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.798809052 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.799170971 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.799243927 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.800157070 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.800218105 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.800672054 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.800734043 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.806375980 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.806466103 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.835880041 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.878525019 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.878567934 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.878657103 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.878705978 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.879709959 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.880723953 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.884885073 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.886071920 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.892075062 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.892263889 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.900180101 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.900654078 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.901913881 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.903986931 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.904036045 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.904077053 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.904104948 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.904117107 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.904126883 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.904179096 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.904266119 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.912971973 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.913280010 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.914521933 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.914671898 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.914866924 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.914928913 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.915704012 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:47.915791035 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:47.990564108 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.001413107 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.003801107 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.004724979 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.004750967 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.004765987 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.004781961 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.004911900 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.004940987 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.004949093 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.005037069 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.022629023 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.024735928 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.025062084 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.033099890 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.033355951 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.221014023 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.221395016 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.221446037 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.262764931 CEST	80	49698	93.184.220.29	192.168.2.3
Aug 3, 2021 03:33:48.263081074 CEST	49698	80	192.168.2.3	93.184.220.29
Aug 3, 2021 03:33:48.334764004 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.334830999 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.334886074 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.335002899 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.335055113 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.335150003 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.335156918 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.441071987 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.441653013 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.441803932 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.442143917 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.444627047 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.444766045 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.444999933 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.447355986 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.447464943 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.447478056 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.448714972 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.448816061 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.449398041 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.453231096 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.453334093 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.454606056 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.471576929 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.545953035 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.546066046 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.546761990 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.546824932 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.547291994 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.547353029 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.547741890 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.547802925 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.551222086 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.551311016 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.557719946 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.557817936 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.558950901 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.559032917 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.559551001 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.559632063 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.559638023 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.559716940 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.560935974 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.561021090 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.574826956 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.574969053 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.576004028 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.576097965 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:48.576838970 CEST	5656	49756	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:48.576932907 CEST	49756	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:52.751409054 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:52.855606079 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:52.855712891 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:52.859023094 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:53.019023895 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:53.019156933 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:53.156049967 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:53.156178951 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:53.320569038 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:53.320647001 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:53.642678976 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:53.738439083 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:53.738564014 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:53.799328089 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:53.799566031 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:53.844451904 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:53.844584942 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:53.946913958 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:53.971869946 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.034010887 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.034153938 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.035168886 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.035222054 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.035433054 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.040355921 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.040409088 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.040462971 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.040478945 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.040534973 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.040570021 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.040595055 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.040648937 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.040656090 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.040740967 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.125802994 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.125912905 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.138288975 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.138390064 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.139345884 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.139430046 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.142515898 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.142577887 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.142638922 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.142679930 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.142694950 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.142767906 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.147258997 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.147567034 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.151436090 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.151523113 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.249455929 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.249727011 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.249782085 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.250508070 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.250655890 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.250762939 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.250812054 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.251214981 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.251323938 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.273082018 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.273323059 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.280421019 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.280647039 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.281450033 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.281621933 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.281644106 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.281678915 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.281709909 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.281764030 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.431602001 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.431663036 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.431799889 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.431842089 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.434637070 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.434825897 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.451617002 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.451838970 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.569243908 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.569308996 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.569365025 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.569417000 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.569510937 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.569562912 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.569600105 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.584383965 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.584666967 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.689784050 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.690035105 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.723737001 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.723978043 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.737396955 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.840909958 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.841160059 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.843508005 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.843552113 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.843602896 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.843651056 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.843698025 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.843755007 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.843791962 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.843797922 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:54.845386028 CEST	5656	49757	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:54.845612049 CEST	49757	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:58.841490984 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:58.969245911 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:58.969350100 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:58.969834089 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.174434900 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.177225113 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.300656080 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.301778078 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.409676075 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.409898043 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.526937962 CEST	443	49696	204.79.197.200	192.168.2.3
Aug 3, 2021 03:33:59.563049078 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.563153028 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.720604897 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.721647024 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.840816021 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.840873003 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.840966940 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.859626055 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.859677076 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.859714985 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.859752893 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.859788895 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.859801054 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.859849930 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.859890938 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.859910011 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.859944105 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.861042023 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.861120939 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.948254108 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.948685884 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.949798107 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.949841022 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.949879885 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.949918985 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.949939013 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.964025021 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.964811087 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.964859962 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.964883089 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.964914083 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.965583086 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.965657949 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.971307039 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.971362114 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.971399069 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.971524954 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.971591949 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.971681118 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.971728086 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.971771955 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.971788883 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.971802950 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.971842051 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:33:59.971893072 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:33:59.972148895 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.054224014 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.056509018 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.056550026 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.072067022 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.072165966 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.072798014 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.072837114 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.072885036 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.072904110 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.075225115 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.075938940 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.076015949 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.076823950 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.076864004 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.076879978 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.076934099 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.077363014 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.077421904 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.229988098 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.231141090 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.304708958 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.305319071 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.305444002 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.305660963 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.306041956 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.306081057 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.306113958 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.306138992 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.306200981 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.306226015 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.306655884 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.306727886 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.307310104 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.307394981 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.527492046 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.527717113 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.527952909 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.528059006 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.528656960 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.528755903 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.529170990 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.529259920 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.531516075 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.531631947 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.632711887 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.633460045 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.633865118 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.633935928 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.639691114 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.640115976 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.640182018 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.672091961 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.672846079 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.672986031 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.673116922 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.673183918 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.673222065 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.673273087 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.674179077 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.676851988 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.741956949 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.745409966 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.745702028 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.745784044 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.746498108 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.746596098 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.784900904 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.785489082 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.785593033 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.786514044 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.787729025 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.787815094 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.793595076 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.793745995 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.800272942 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.851284981 CEST	80	49698	93.184.220.29	192.168.2.3
Aug 3, 2021 03:34:00.851469994 CEST	49698	80	192.168.2.3	93.184.220.29
Aug 3, 2021 03:34:00.875328064 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.876014948 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.876060009 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.876102924 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.876122952 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.906687975 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.906745911 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.906801939 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.906822920 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.907166004 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.907208920 CEST	5656	49758	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:00.907227993 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:00.907258987 CEST	49758	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:04.852117062 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:04.972040892 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:04.972166061 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:04.972455978 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.122195005 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.325579882 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.325856924 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.434319019 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.435031891 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.586515903 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.641833067 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.643249989 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.643332005 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.643800974 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.645675898 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.645755053 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.652802944 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.654150963 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.654666901 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.654788017 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.656819105 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.656919956 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.658560038 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.659723043 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.749418020 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.749586105 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.750341892 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.750449896 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.751344919 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.751436949 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.752413034 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.752482891 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.754218102 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.754817009 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.761959076 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.762173891 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.763312101 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.763381004 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.764264107 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.764405966 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.776910067 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.776992083 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.861705065 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.862179041 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.862418890 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.862477064 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.882071018 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.882174969 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.883172035 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.883224010 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.883367062 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.883414030 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.884826899 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.884876013 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.966559887 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.966639996 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.967160940 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.967220068 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.986305952 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.986526966 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.988028049 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.988123894 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:05.989691973 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:05.989908934 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.003309011 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.003998041 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.141207933 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.142272949 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.142985106 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.143073082 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.144778967 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.146192074 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.148688078 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.148792982 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.199440956 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.202256918 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.338128090 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.338221073 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.339032888 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.339091063 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.498348951 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.502229929 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.524703979 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.524795055 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.607848883 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.631392956 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.631875992 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.631983995 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.633467913 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.633533001 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.635350943 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.635793924 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.635850906 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.635910988 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.740855932 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.740989923 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.741604090 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.741679907 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.743720055 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.744661093 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.744694948 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.744748116 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.744992971 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.745573997 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.746000051 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.746241093 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.944922924 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.945162058 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.945638895 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.955996037 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.956166029 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.956819057 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.956922054 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.957721949 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.957822084 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:06.958631039 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:06.958731890 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.158668995 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.158817053 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.285816908 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.285994053 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.287080050 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.287195921 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.288395882 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.288497925 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.288887024 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.288912058 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.288989067 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.289014101 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.291762114 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.291850090 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.327194929 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.327299118 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.328068018 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.328130960 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.328154087 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.328260899 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.328273058 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.328382969 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.328453064 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.328723907 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.328787088 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.328890085 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.329585075 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.329668999 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.363749981 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.363841057 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.500900984 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.501034975 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.501887083 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.501952887 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.503246069 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.503350019 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.527220011 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.527385950 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.538584948 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.538661003 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.539347887 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.539391041 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.539414883 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.539468050 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.539838076 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.539901972 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.654361963 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.654500008 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.654522896 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.654578924 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.655427933 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.655491114 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.667036057 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.667119026 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.670488119 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.670569897 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.670644999 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.670677900 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.671693087 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.671757936 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.671812057 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.671827078 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.671859026 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.671865940 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.671930075 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.846146107 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.846338987 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.846366882 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.846437931 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.846463919 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.846515894 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.846519947 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.846575022 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.846579075 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.846630096 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.846635103 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.846694946 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.847718000 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.847768068 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:07.847798109 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:07.847821951 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.002604008 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.002661943 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.002804995 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.002863884 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.004126072 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.004225969 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.011965036 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.012167931 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.012316942 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.012444019 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.014360905 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.014453888 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.014689922 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.014770031 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.015635967 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.015727997 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.163925886 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.164022923 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.164243937 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.164310932 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.165843964 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.165929079 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.166091919 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.166157961 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.167571068 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.167639017 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.167716980 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.167785883 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.276199102 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.276319981 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.276838064 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.276905060 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.277549982 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.277611971 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.277657986 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.277703047 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.278323889 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.278388023 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.278922081 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.278950930 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.278986931 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.279012918 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.279804945 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.279872894 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.473701954 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.473886967 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.474878073 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.474946022 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.476767063 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.476897001 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.476968050 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.477022886 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.478651047 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.478707075 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.582832098 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.582918882 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.583318949 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.583401918 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.606899977 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.607079983 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.607703924 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.607785940 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.607875109 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.607935905 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.644026995 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.644160986 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.650846004 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.697665930 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.697915077 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.733860970 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.734082937 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.768198013 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.768271923 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.768424034 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.768481970 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.769269943 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.769339085 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.769572973 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.769625902 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.769974947 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.770016909 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.770040035 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.770064116 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.876729012 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.876827002 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.893789053 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.893965960 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.953871012 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.953933954 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.953950882 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.954659939 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.954704046 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.954710960 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.955404043 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.955461025 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:08.956031084 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.983860016 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:08.983943939 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.005390882 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.005489111 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.083700895 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.083789110 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.084033012 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.084100962 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.084199905 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.084252119 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.090390921 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.090435028 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.090540886 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.175270081 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.175347090 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.314861059 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.314980984 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.392158985 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.392246962 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.392656088 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.392698050 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.392720938 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.392752886 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.394753933 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.394795895 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.394836903 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.394866943 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.401786089 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.401859045 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.449013948 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.463571072 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.463668108 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.496076107 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.496141911 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.496186972 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.500958920 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.501029968 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.501488924 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.598264933 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.598326921 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.598380089 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.598419905 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.603161097 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.603243113 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.603272915 CEST	5656	49759	185.244.30.22	192.168.2.3
Aug 3, 2021 03:34:09.603346109 CEST	49759	5656	192.168.2.3	185.244.30.22
Aug 3, 2021 03:34:09.818203926 CEST	5656	49759	185.244.30.22	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 3, 2021 03:31:49.568717957 CEST	57544	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:31:49.604372978 CEST	53	57544	8.8.8.8	192.168.2.3
Aug 3, 2021 03:31:50.238764048 CEST	55984	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:31:50.264038086 CEST	53	55984	8.8.8.8	192.168.2.3
Aug 3, 2021 03:31:59.450725079 CEST	64185	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:31:59.484168053 CEST	53	64185	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:01.459546089 CEST	65110	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:01.494106054 CEST	53	65110	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:01.928421021 CEST	58361	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:01.953347921 CEST	53	58361	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:02.915808916 CEST	63492	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:02.949610949 CEST	53	63492	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:04.053642035 CEST	60831	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:04.078742981 CEST	53	60831	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:04.755917072 CEST	60100	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:04.780930042 CEST	53	60100	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:05.873358965 CEST	53195	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:05.899503946 CEST	53	53195	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:06.560197115 CEST	50141	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:06.595525980 CEST	53	50141	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:07.284277916 CEST	53023	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:07.311912060 CEST	53	53023	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:07.727443933 CEST	49563	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:07.762829065 CEST	53	49563	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:07.975522041 CEST	51352	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:08.012305975 CEST	53	51352	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:08.970345974 CEST	59349	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:08.999629021 CEST	53	59349	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:10.023586035 CEST	57084	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:10.048660040 CEST	53	57084	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:10.744406939 CEST	58823	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:10.771956921 CEST	53	58823	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:11.706285000 CEST	57568	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:11.734200954 CEST	53	57568	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:12.893038988 CEST	50540	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:12.928888083 CEST	53	50540	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:13.963527918 CEST	54366	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:13.995934963 CEST	53	54366	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:15.629363060 CEST	53034	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:15.653919935 CEST	53	53034	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:17.219129086 CEST	57762	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:17.254772902 CEST	53	57762	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:19.907943010 CEST	55435	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:19.943284988 CEST	53	55435	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:26.012536049 CEST	50713	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:26.048392057 CEST	53	50713	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:27.197000980 CEST	56132	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:27.233195066 CEST	53	56132	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:32.371571064 CEST	58987	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:32.403898954 CEST	53	58987	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:41.492619038 CEST	56579	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:41.526473045 CEST	53	56579	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:47.952207088 CEST	60633	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:47.976875067 CEST	53	60633	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:51.863406897 CEST	61292	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:51.905147076 CEST	53	61292	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:53.899343967 CEST	63619	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:53.936256886 CEST	53	63619	8.8.8.8	192.168.2.3
Aug 3, 2021 03:32:55.367870092 CEST	64938	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:32:55.394695997 CEST	53	64938	8.8.8.8	192.168.2.3
Aug 3, 2021 03:33:02.150737047 CEST	61946	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:33:02.184956074 CEST	53	61946	8.8.8.8	192.168.2.3
Aug 3, 2021 03:33:08.559366941 CEST	64910	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:33:08.584351063 CEST	53	64910	8.8.8.8	192.168.2.3
Aug 3, 2021 03:33:14.747713089 CEST	52123	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:33:14.780982971 CEST	53	52123	8.8.8.8	192.168.2.3
Aug 3, 2021 03:33:20.908586025 CEST	56130	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:33:20.944596052 CEST	53	56130	8.8.8.8	192.168.2.3
Aug 3, 2021 03:33:26.054903030 CEST	56338	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:33:26.088956118 CEST	53	56338	8.8.8.8	192.168.2.3
Aug 3, 2021 03:33:27.059242964 CEST	59420	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:33:27.093126059 CEST	53	59420	8.8.8.8	192.168.2.3
Aug 3, 2021 03:33:32.376171112 CEST	58784	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:33:32.417201996 CEST	53	58784	8.8.8.8	192.168.2.3
Aug 3, 2021 03:33:33.107549906 CEST	63978	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:33:33.143085957 CEST	53	63978	8.8.8.8	192.168.2.3
Aug 3, 2021 03:33:33.388942957 CEST	62938	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:33:33.421489954 CEST	53	62938	8.8.8.8	192.168.2.3
Aug 3, 2021 03:33:39.841692924 CEST	55708	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:33:39.878473043 CEST	53	55708	8.8.8.8	192.168.2.3
Aug 3, 2021 03:33:46.470058918 CEST	56803	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:33:46.502367020 CEST	53	56803	8.8.8.8	192.168.2.3
Aug 3, 2021 03:33:52.714616060 CEST	57145	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:33:52.748580933 CEST	53	57145	8.8.8.8	192.168.2.3
Aug 3, 2021 03:33:58.801398039 CEST	55359	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:33:58.836028099 CEST	53	55359	8.8.8.8	192.168.2.3
Aug 3, 2021 03:34:04.816489935 CEST	58306	53	192.168.2.3	8.8.8.8
Aug 3, 2021 03:34:04.851423025 CEST	53	58306	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 3, 2021 03:32:01.459546089 CEST	192.168.2.3	8.8.8.8	0xae9c	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:32:07.727443933 CEST	192.168.2.3	8.8.8.8	0x275a	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:32:12.893038988 CEST	192.168.2.3	8.8.8.8	0x328c	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:32:19.907943010 CEST	192.168.2.3	8.8.8.8	0x17e8	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:32:26.012536049 CEST	192.168.2.3	8.8.8.8	0xd834	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:32:32.371571064 CEST	192.168.2.3	8.8.8.8	0xa93a	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:32:41.492619038 CEST	192.168.2.3	8.8.8.8	0x37d6	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:32:47.952207088 CEST	192.168.2.3	8.8.8.8	0x6a52	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:32:55.367870092 CEST	192.168.2.3	8.8.8.8	0x3950	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:02.150737047 CEST	192.168.2.3	8.8.8.8	0xae82	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:08.559366941 CEST	192.168.2.3	8.8.8.8	0x8027	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:14.747713089 CEST	192.168.2.3	8.8.8.8	0xae74	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:20.908586025 CEST	192.168.2.3	8.8.8.8	0x8775	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:27.059242964 CEST	192.168.2.3	8.8.8.8	0x79c9	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:33.388942957 CEST	192.168.2.3	8.8.8.8	0x39f4	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:39.841692924 CEST	192.168.2.3	8.8.8.8	0xdd75	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:46.470058918 CEST	192.168.2.3	8.8.8.8	0xf814	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:52.714616060 CEST	192.168.2.3	8.8.8.8	0xb9c8	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:58.801398039 CEST	192.168.2.3	8.8.8.8	0xa220	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)
Aug 3, 2021 03:34:04.816489935 CEST	192.168.2.3	8.8.8.8	0xfaa0	Standard query (0)	sobe123.ddns.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Aug 3, 2021 03:32:01.494106054 CEST	8.8.8.8	192.168.2.3	0xae9c	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:32:07.762829065 CEST	8.8.8.8	192.168.2.3	0x275a	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:32:12.928888083 CEST	8.8.8.8	192.168.2.3	0x328c	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:32:19.943284988 CEST	8.8.8.8	192.168.2.3	0x17e8	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:32:26.048392057 CEST	8.8.8.8	192.168.2.3	0xd834	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:32:32.403898954 CEST	8.8.8.8	192.168.2.3	0xa93a	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:32:41.526473045 CEST	8.8.8.8	192.168.2.3	0x37d6	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:32:47.976875067 CEST	8.8.8.8	192.168.2.3	0x6a52	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:32:55.394695997 CEST	8.8.8.8	192.168.2.3	0x3950	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:02.184956074 CEST	8.8.8.8	192.168.2.3	0xae82	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:08.584351063 CEST	8.8.8.8	192.168.2.3	0x8027	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:14.780982971 CEST	8.8.8.8	192.168.2.3	0xae74	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:20.944596052 CEST	8.8.8.8	192.168.2.3	0x8775	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:27.093126059 CEST	8.8.8.8	192.168.2.3	0x79c9	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:33.421489954 CEST	8.8.8.8	192.168.2.3	0x39f4	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:39.878473043 CEST	8.8.8.8	192.168.2.3	0xdd75	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:46.502367020 CEST	8.8.8.8	192.168.2.3	0xf814	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:52.748580933 CEST	8.8.8.8	192.168.2.3	0xb9c8	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:33:58.836028099 CEST	8.8.8.8	192.168.2.3	0xa220	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)
Aug 3, 2021 03:34:04.851423025 CEST	8.8.8.8	192.168.2.3	0xfaa0	No error (0)	sobe123.ddns.net	185.244.30.22	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Orderpdf.exe PID: 1268 Parent PID: 5648

General

Start time:	03:31:57
Start date:	03/08/2021
Path:	C:\Users\user\Desktop\Orderpdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Orderpdf.exe'
Imagebase:	0x400000
File size:	869938 bytes
MD5 hash:	2849C98C8D071260B2618BEACF873A98
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Nanocore_RAT_Gen_2, Description: Detetcs the Nanocore RAT, Source: 00000000.00000002.205053043.0000000002120000.00000040.00000001.sdmp, Author: Florian Roth Rule: Nanocore_RAT_Feb18_1, Description: Detects Nanocore RAT, Source: 00000000.00000002.205053043.0000000002120000.00000040.00000001.sdmp, Author: Florian Roth Rule: JoeSecurity_Nanocore, Description: Yara detected Nanocore RAT, Source: 00000000.00000002.205053043.0000000002120000.00000040.00000001.sdmp, Author: Joe Security Rule: NanoCore, Description: unknown, Source: 00000000.00000002.205053043.0000000002120000.00000040.00000001.sdmp, Author: Kevin Breen <kevin@techanarchy.net>
Reputation:	low

Chronological Activities

Analysis Process: MSBuild.exe PID: 5876 Parent PID: 1268

General

Start time:	03:31:57
Start date:	03/08/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Orderpdf.exe'
Imagebase:	0xd90000
File size:	69632 bytes
MD5 hash:	88BBB7610152B48C2B3879473B17857E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Chronological Activities

Analysis Process: schtasks.exe PID: 4436 Parent PID: 5876

General

Start time:	03:31:59
Start date:	03/08/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'schtasks.exe' /create /f /tn 'DHCP Monitor' /xml 'C:\Users\user\AppData\Local\Temp\tmp86BE.tmp'
Imagebase:	0x1240000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 1636 Parent PID: 4436

General

Start time:	03:32:00
Start date:	03/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: MSBuild.exe PID: 6004 Parent PID: 528

General

Start time:	03:32:02
Start date:	03/08/2021
Path:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 0
Imagebase:	0x6d0000
File size:	69632 bytes
MD5 hash:	88BBB7610152B48C2B3879473B17857E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Chronological Activities

Analysis Process: conhost.exe PID: 6076 Parent PID: 6004

General

Start time:	03:32:02
Start date:	03/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6b2800000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Orderpdf.exe PID: 1268 Parent PID: 5648 Orderpdf.exeCOMMON

Executed Functions

Function 00477095, Relevance: 10.7, APIs: 7, Instructions: 175memoryfileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,80000000,00000007,00000000,00000003,00000080,00000000), ref: 00477131
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000004), ref: 00477159
ReadFile.KERNELBASE(?,00000000,00000000,?,00000000), ref: 00477170
VirtualAlloc.KERNELBASE(00000000,00001833,00003000,00000040), ref: 004771B9
und_memcpy.LIBVCRUNTIME ref: 004771C9
VirtualAlloc.KERNELBASE(00000000,00000000,00003000,00000040), ref: 004771DA
und_memcpy.LIBVCRUNTIME ref: 004771E9

Memory Dump Source

Source File: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual$Fileund_memcpy$CreateRead
String ID:
API String ID: 1653714324-0
Opcode ID: 7fdd32e0ddf0d9755cdd87a80c87b70b98fe079a458ae50d8c795eaa45a75218
Instruction ID: 9d3cd884da3ea75aa4dddbc36143b71ddd8cf897812d6175ddf5b53feb4b5334
Opcode Fuzzy Hash: 7fdd32e0ddf0d9755cdd87a80c87b70b98fe079a458ae50d8c795eaa45a75218
Instruction Fuzzy Hash: 2F51F5B1901214AFEB109BB5CCA5FEB7BF8EF45710F518196FA14E7282D2389A058B64

Uniqueness

Uniqueness Score: -1.00%

Function 0041E650, Relevance: 4.6, APIs: 3, Instructions: 87memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE(00477000,0000028B,00000040,?,394BD140), ref: 0041E69C
GetDC.USER32(00000000), ref: 0041E6BC
GrayStringA.USER32(00000000), ref: 0041E6C3

Part of subcall function 0041EA40: LoadImageW.USER32 ref: 0041EB31
Part of subcall function 0041EA40: LoadImageW.USER32 ref: 0041EB48
Part of subcall function 0041EA40: LoadCursorW.USER32(00000000,00007F00), ref: 0041EB5B
Part of subcall function 0041EA40: RegisterClassExW.USER32 ref: 0041EB6E
Part of subcall function 0041EA40: AdjustWindowRect.USER32 ref: 0041EBA4

Part of subcall function 0041F250: PeekMessageW.USER32 ref: 0041F265
Part of subcall function 0041F250: TranslateMessage.USER32(?), ref: 0041F273
Part of subcall function 0041F250: DispatchMessageW.USER32 ref: 0041F27D

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: LoadMessage$Image$AdjustClassCursorDispatchGrayPeekProtectRectRegisterStringTranslateVirtualWindow
String ID:
API String ID: 4190410384-0
Opcode ID: afb790432f9315580c17e5b251265e45263ee1e3c0c2a891a2dad1681e11a2ce
Instruction ID: 4ee2af076da54124f04449dc60bd2a4bd18c183bee1d70563fb7579e34aa7f38
Opcode Fuzzy Hash: afb790432f9315580c17e5b251265e45263ee1e3c0c2a891a2dad1681e11a2ce
Instruction Fuzzy Hash: 4C31C374904248EEEB10DF65CD45BEEB7B8EB04300F1081AAA519A61C2DB781B84CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0042F104, Relevance: 4.5, APIs: 3, Instructions: 37COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0042F108
_free.LIBCMT ref: 0042F141
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0042F148

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentStrings$Free_free
String ID:
API String ID: 2716640707-0
Opcode ID: aca802fcd46211519548efc9c1d9c82cb1ee1ec3714558ebbee1563d685cb2d5
Instruction ID: 12e7466e5675c66688b785673d73f10455241bfcc4c51c948e8c475d37bc6da2
Opcode Fuzzy Hash: aca802fcd46211519548efc9c1d9c82cb1ee1ec3714558ebbee1563d685cb2d5
Instruction Fuzzy Hash: C6E02B3B7055317692112236BC86D7B192DCFC57747E7013BF82853286EE194C0600BD

Uniqueness

Uniqueness Score: -1.00%

Function 0042F330, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00426CDF: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00429732,00000001,00000364,00000006,000000FF,?,?,?,00426DDE,00423F6C), ref: 00426D20

_free.LIBCMT ref: 0042F39F

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 17007b471d999c07488c92991059f52c6fa96fb8df87c9fe2de7279ec7fe51db
Instruction ID: 93a066878a5ab5d11835a37130dc79472d36da45581dc96c85ca6d651933d04f
Opcode Fuzzy Hash: 17007b471d999c07488c92991059f52c6fa96fb8df87c9fe2de7279ec7fe51db
Instruction Fuzzy Hash: 040126727043266BC320CF69D88198AFBE8FB043B4F95023EE955A7AC0D3746C1487A8

Uniqueness

Uniqueness Score: -1.00%

Function 00426CDF, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00429732,00000001,00000364,00000006,000000FF,?,?,?,00426DDE,00423F6C), ref: 00426D20

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b3d938777a93dbe8dcdbddf043c124bb34c17ec1e877ee12e6c28c8e01564d6d
Instruction ID: e0e6cd26b64d7f839606a01775103c8a1c7f9e6c47b6c63e79006d741404f437
Opcode Fuzzy Hash: b3d938777a93dbe8dcdbddf043c124bb34c17ec1e877ee12e6c28c8e01564d6d
Instruction Fuzzy Hash: D8F02B3132513DA7EB216A267C0565B3B59EB40760B978027AC04D6156CE28DC0046EC

Uniqueness

Uniqueness Score: -1.00%

Function 00426E42, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00000000,?,?,00420759,00000000,?,00417BA0,00000000,?,00000000), ref: 00426E74

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 322a9f5d8bdc647fb9f681a08e6fd8180c1ffb1560ce72417e0debb3438113fe
Instruction ID: b4ee86908fd66943ce101bdd418922825bf7bd0004a3c2762acb01118052d33f
Opcode Fuzzy Hash: 322a9f5d8bdc647fb9f681a08e6fd8180c1ffb1560ce72417e0debb3438113fe
Instruction Fuzzy Hash: 7FE0E53A30167567E63127A6FC0575B36499F017E0FC70227EC08962A0CF18DC0081ED

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00419340, Relevance: 88.2, APIs: 23, Strings: 27, Instructions: 735COMMON

Download Yara Rule

APIs

Part of subcall function 00418760: GdiplusStartup.GDIPLUS(00477EB8,00000001,00000000,00000000,00000000,00000000), ref: 004187B4

allocator.LIBCPMTD ref: 00419531
allocator.LIBCPMTD ref: 00419555
allocator.LIBCPMTD ref: 00419572
D3D11CreateDeviceAndSwapChain.D3D11(00000000,00000001,00000000,00000000,00009100,00000001,00000007,00000280,00000000,?,00000000,?,?,00000000,?,00000280), ref: 004195A3
__CxxThrowException@8.LIBVCRUNTIME ref: 004195F7
allocator.LIBCPMTD ref: 0041963B
allocator.LIBCPMTD ref: 004198D1
__CxxThrowException@8.LIBVCRUNTIME ref: 0041994D
allocator.LIBCPMTD ref: 004199CB
__CxxThrowException@8.LIBVCRUNTIME ref: 00419A54
allocator.LIBCPMTD ref: 00419A8C
__CxxThrowException@8.LIBVCRUNTIME ref: 00419B0B
allocator.LIBCPMTD ref: 00419B43
__CxxThrowException@8.LIBVCRUNTIME ref: 00419BC2
allocator.LIBCPMTD ref: 00419DD6
__CxxThrowException@8.LIBVCRUNTIME ref: 00419E57
allocator.LIBCPMTD ref: 00419F1B
__CxxThrowException@8.LIBVCRUNTIME ref: 00419FA1
allocator.LIBCPMTD ref: 0041A039
__CxxThrowException@8.LIBVCRUNTIME ref: 004196B2

Part of subcall function 00421BA4: RaiseException.KERNEL32(?,?,?,0042110A,?,?,?,?,?,?,?,?,0042110A,00417BA0,004759CC,00417BA0), ref: 00421C03

allocator.LIBCPMTD ref: 004196EA
__CxxThrowException@8.LIBVCRUNTIME ref: 00419768
__CxxThrowException@8.LIBVCRUNTIME ref: 0041A0B3

Strings

W, xrefs: 00419867
Graphics.cpp, xrefs: 00419B98
, xrefs: 004194D0
W, xrefs: 004194B2
Graphics.cpp, xrefs: 00419E2D
Graphics.cpp, xrefs: 00419F77
Creating render target view on backbuffer, xrefs: 00419728
Graphics.cpp, xrefs: 004195CD
Creating pixel shader, xrefs: 00419AC8
Graphics.cpp, xrefs: 00419AE1
Creating sysbuffer texture, xrefs: 0041990A
key.hWnd != nullptr, xrefs: 00419474
Creating vertex shader, xrefs: 00419B7F
Creating device and swap chain, xrefs: 004195B7
Creating vertex buffer, xrefs: 00419E14
Creating sampler state, xrefs: 0041A070
Graphics.cpp, xrefs: 00419923
Graphics.cpp, xrefs: 0041A089
Graphics.cpp, xrefs: 00419688
<, xrefs: 004194C6
Getting back buffer, xrefs: 00419672
x, xrefs: 00419D74
Graphics.cpp, xrefs: 00419A2A
Graphics.cpp, xrefs: 0041973E
Creating input layout, xrefs: 00419F5E
Graphics.cpp, xrefs: 0041946F
Creating view on sysBuffer texture, xrefs: 00419A11

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: allocator$Exception@8Throw$ChainCreateDeviceExceptionGdiplusRaiseStartupSwap
String ID: $<$Creating device and swap chain$Creating input layout$Creating pixel shader$Creating render target view on backbuffer$Creating sampler state$Creating sysbuffer texture$Creating vertex buffer$Creating vertex shader$Creating view on sysBuffer texture$Getting back buffer$Graphics.cpp$Graphics.cpp$Graphics.cpp$Graphics.cpp$Graphics.cpp$Graphics.cpp$Graphics.cpp$Graphics.cpp$Graphics.cpp$Graphics.cpp$Graphics.cpp$W$W$key.hWnd != nullptr$x
API String ID: 1145032029-1248215945
Opcode ID: a3e2298f776fa2d1fa99a676f366f77a8bb7d99daced5e536fef888c14262fc5
Instruction ID: c034b17d2d84be23c680acf38bc58640e870766c8f9902cb52a08bc39c4f51d1
Opcode Fuzzy Hash: a3e2298f776fa2d1fa99a676f366f77a8bb7d99daced5e536fef888c14262fc5
Instruction Fuzzy Hash: 77725DB09012589FDB24DB66CC91BDEB774AF89308F0441DEE10977291EBB86AC4CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00430525, Relevance: 10.2, APIs: 1, Strings: 4, Instructions: 1427COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 004306E1

Strings

1#IND, xrefs: 004319BE
1#SNAN, xrefs: 004319C8
1#INF, xrefs: 004319DC
1#QNAN, xrefs: 004319D2

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 1491473f2d908b4c344e4469fa9847a2fb77b6bcedb002dfbe98ba2ad51cbf66
Instruction ID: 6851d71ad97e1a8bb947b70a46825bdafcfb08b1df3ea2ba2203c1976a3c5cde
Opcode Fuzzy Hash: 1491473f2d908b4c344e4469fa9847a2fb77b6bcedb002dfbe98ba2ad51cbf66
Instruction Fuzzy Hash: F8D24971E082298FDB64DE28DD507EAB7B5EB88305F1452EBD40DE7240E778AE818F45

Uniqueness

Uniqueness Score: -1.00%

Function 00425E37, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00425F2F
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00425F39
UnhandledExceptionFilter.KERNEL32(?), ref: 00425F46

Strings

73@, xrefs: 00425E39

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID: 73@
API String ID: 3906539128-1557270183
Opcode ID: 08f77fa71548fc297f429eb73abfae0dcc77f94c340e0edb0db62331e5e0a740
Instruction ID: c75d02328143f1e8118e8caeec08a8f38e7e04b47e68a417667edeceea429ec6
Opcode Fuzzy Hash: 08f77fa71548fc297f429eb73abfae0dcc77f94c340e0edb0db62331e5e0a740
Instruction Fuzzy Hash: 1C31C774901228ABCB21DF65DD89BCDBBB4BF18310F5041EAE41CA7291E7749F858F48

Uniqueness

Uniqueness Score: -1.00%

Function 00427A76, Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00427A75,00000000,00000280,?,00000000,?,0042420E), ref: 00427A98
TerminateProcess.KERNEL32(00000000,?,00427A75,00000000,00000280,?,00000000,?,0042420E), ref: 00427A9F
ExitProcess.KERNEL32 ref: 00427AB1

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ed8b6c717440bbb3316e8c621687a928be127d03ed354f91747c23d9fd6043ed
Instruction ID: bdf9a0d60250af176f2cc24bd085e5ee7350a0804d2798dff3a597804655b857
Opcode Fuzzy Hash: ed8b6c717440bbb3316e8c621687a928be127d03ed354f91747c23d9fd6043ed
Instruction Fuzzy Hash: 55E04631204168FFCB15AF25EC0AA0D3B39EB40351B418029F80586231CB3ADE82CB48

Uniqueness

Uniqueness Score: -1.00%

Function 00421128, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 132COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00421141

Strings

, xrefs: 0042129E

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-3916222277
Opcode ID: 7faf3e3f4124cc36c8adb451f052f84af1162f93449b79c4672ab75e8e2aa61a
Instruction ID: 4b32213c481ad1dc525a97d44fef5ca4b1bec866713463c88c3d5ef890c0f7b2
Opcode Fuzzy Hash: 7faf3e3f4124cc36c8adb451f052f84af1162f93449b79c4672ab75e8e2aa61a
Instruction Fuzzy Hash: 5D41B2B1A002159BEB24CF99E9857AABBF4FB18314F50816FE909E73A0D7749940CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00426F60, Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75d556e27c90158cdabf74ed572a3d2714a3a0a00ff9552e6289904192c072b5
Instruction ID: a7a9b4d2f7f56b77e5cc65cd79cefa9ba40828eb4c808aba222ab2aa27e20418
Opcode Fuzzy Hash: 75d556e27c90158cdabf74ed572a3d2714a3a0a00ff9552e6289904192c072b5
Instruction Fuzzy Hash: 7FF16E71E042299FDF14CFA9D8806AEBBB1FF48314F55826AE815A7344D735AD01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0042B27F, Relevance: 3.1, APIs: 2, Instructions: 55COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,00000280,?,00426361,?,Microsoft Visual C++ Runtime Library,00012012,?,00000240,00000280,00000280,0000002E,?,?,00000000,00000480), ref: 0042B208
OutputDebugStringW.KERNEL32(394BD140,?,00426361,?,Microsoft Visual C++ Runtime Library,00012012,?,00000240,00000280,00000280,0000002E,?,?,00000000,00000480), ref: 0042B21F

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: DebugDebuggerOutputPresentString
String ID:
API String ID: 4086329628-0
Opcode ID: 4198d2ba333bb733f1715d06dd1ed205f9662859951f563c4be47205bb118274
Instruction ID: ac7c5c394ffdd5c1d9cd01146f6e5a64b4fd37b5b4f222996049083401c5939e
Opcode Fuzzy Hash: 4198d2ba333bb733f1715d06dd1ed205f9662859951f563c4be47205bb118274
Instruction Fuzzy Hash: E7019E31341334F69E206AA27C4AB7F370DEF01365F984497BD1996202CB29C811A6FE

Uniqueness

Uniqueness Score: -1.00%

Function 0042CA20, Relevance: 1.8, APIs: 1, Instructions: 274COMMON

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0042CA1B,?,?,?,?,?,?,00000000), ref: 0042CC4D

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: fd55e1bd8331077f777ad0cd1ecd4a4b19c096822351e475e264bc967a1e935c
Instruction ID: 1cedab9138e1107ab5bf64efeb2c1c7776d5790bf4f426b9e27aeea9772e4aee
Opcode Fuzzy Hash: fd55e1bd8331077f777ad0cd1ecd4a4b19c096822351e475e264bc967a1e935c
Instruction Fuzzy Hash: 49B13A316106188FD715CF28E4C6B697BA0FF45364F65865AE89ACF3A1C339E982CB44

Uniqueness

Uniqueness Score: -1.00%

Function 0042E672, Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 178a21b89bde08581e6bfffb77999f8aa59cac48294077b33fb95ab725858a3e
Instruction ID: 9343286b34dd876fa992e59d9cb74ae737beb1d298f3810d729e5724237b2b7c
Opcode Fuzzy Hash: 178a21b89bde08581e6bfffb77999f8aa59cac48294077b33fb95ab725858a3e
Instruction Fuzzy Hash: DE310B72A002296FCB24EF6ADC85DBB7779EBC4314F9441ADF90597241EA34AE40CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0042502A, Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

0, xrefs: 004251BA

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 59e7864cb3b4e9e9dbabdd1be006159fc876ca84fd51e00942644981f4f2d680
Instruction ID: bbf27b51ce4c6d5a344ad633f1e90adb80f45c33e8746a07d14b6005d63cf638
Opcode Fuzzy Hash: 59e7864cb3b4e9e9dbabdd1be006159fc876ca84fd51e00942644981f4f2d680
Instruction Fuzzy Hash: 7A616870B00F34AADB389A286C95B7F73A5AB41708FD4051FE542DB380D67D9D42C69E

Uniqueness

Uniqueness Score: -1.00%

Function 00425287, Relevance: 1.5, Strings: 1, Instructions: 237COMMON

Download Yara Rule

Strings

0, xrefs: 00425417

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 7df3f7dead68aabe9e7c66e935f9a0223e568e041f57d023ad7d273371f93c00
Instruction ID: 102d380ed227cbf51b37c2f574c2e09513eddc82c2a141b8eadda50db38f91cd
Opcode Fuzzy Hash: 7df3f7dead68aabe9e7c66e935f9a0223e568e041f57d023ad7d273371f93c00
Instruction Fuzzy Hash: 6B614770700E3497DB28EA69B4857BFA395AB41744FD4142FE842EB3C1D6BC9D82C61E

Uniqueness

Uniqueness Score: -1.00%

Function 00433766, Relevance: 1.4, Strings: 1, Instructions: 104COMMON

Download Yara Rule

Strings

j@C, xrefs: 004337C6

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: j@C
API String ID: 0-2779629771
Opcode ID: 21c906446589468bc3da4143ec31d26a5068a6a99a9403a31eff6d4d6a737096
Instruction ID: 99fa66393ae1c661c2aea2f937c88c0cd73395577f65836a8b59a45a2a44d566
Opcode Fuzzy Hash: 21c906446589468bc3da4143ec31d26a5068a6a99a9403a31eff6d4d6a737096
Instruction Fuzzy Hash: E621B673F2043947770CC57E8C5627DB6E1C78C501745823EF8A6EA2C1D968D917E2E4

Uniqueness

Uniqueness Score: -1.00%

Function 0042D129, Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c8e7b79bdcfdaadfb17fdb8bc3d9889d7ae7afebfde839f3deb83dc6ab80594
Instruction ID: 2b69592765aac0bf5fc071ac9a943f79650e1a25d9e47e0a4b763258befb8140
Opcode Fuzzy Hash: 0c8e7b79bdcfdaadfb17fdb8bc3d9889d7ae7afebfde839f3deb83dc6ab80594
Instruction Fuzzy Hash: 63325522E29F514DD7279639D832336A248AFB73C4F51C737E829B5AA9EF68C4C34105

Uniqueness

Uniqueness Score: -1.00%

Function 00416A80, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56689f239cfbb081858035772a66116e5ffae58fc015ddbfb7c08ec783b825de
Instruction ID: 2f3de8c987ef3c4ffa76788e2a2586fabde25a1c3b47a32f8d4a430edccea48b
Opcode Fuzzy Hash: 56689f239cfbb081858035772a66116e5ffae58fc015ddbfb7c08ec783b825de
Instruction Fuzzy Hash: C751B772C0061E9ACB06DFAADC919FEF375FF48200F158629E521761A0FB706688DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00433646, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a1cbbdd8e34586af442768819d5f5fbabc9dbb273590f086d0667a681d556bcb
Instruction ID: 3ef97b66e2e1c9cfe7db00b8be27487637acc999ae13a73d615d8e0b83a53b8b
Opcode Fuzzy Hash: a1cbbdd8e34586af442768819d5f5fbabc9dbb273590f086d0667a681d556bcb
Instruction Fuzzy Hash: 5311A363F30C256A675C81698C172BAA5D2EBDC25070F533AD826E7384E8A4DE23D290

Uniqueness

Uniqueness Score: -1.00%

Function 0042E3D6, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89981388674210dc1e7539316087abaa685eeccde3421182200c9315c1e92249
Instruction ID: 253d8974160b8ce7b4a5407324c6d2168ae57b64915af27b7c30f2f4171158ae
Opcode Fuzzy Hash: 89981388674210dc1e7539316087abaa685eeccde3421182200c9315c1e92249
Instruction Fuzzy Hash: B5F0BB327401349BCB25EA5EE909B9677A8EB45750F91405BF501DB392CAB9EE40C7C8

Uniqueness

Uniqueness Score: -1.00%

Function 0042E361, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01652d69d25daab859c007e99b097e716055def2deb1d1f82fa02b6f45e6122e
Instruction ID: 971184281eeaa13b16745601e4138d8a99b20e8180faf77689720e73cf7b5019
Opcode Fuzzy Hash: 01652d69d25daab859c007e99b097e716055def2deb1d1f82fa02b6f45e6122e
Instruction Fuzzy Hash: D4F0A031A202349BCB22CB4DD808A8A77ACEB48B15F51405BE545D7280C7B8DD40CBC8

Uniqueness

Uniqueness Score: -1.00%

Function 0042E3A5, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bf5aed5672186d19ca5f9c47a40bc32ef018dc40e6ecb5a5286aede97a979709
Instruction ID: edd76a005114fbeb310cce5be6136924492df9749646eeb73c04d1c914ccab83
Opcode Fuzzy Hash: bf5aed5672186d19ca5f9c47a40bc32ef018dc40e6ecb5a5286aede97a979709
Instruction Fuzzy Hash: 35E04632A11238EBCB24DB9A990498AB3ECEB48B05B9100AAB901D3201C2B8DE00C7D4

Uniqueness

Uniqueness Score: -1.00%

Function 0041EA40, Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 149registryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32 ref: 0041EB31
LoadImageW.USER32 ref: 0041EB48
LoadCursorW.USER32(00000000,00007F00), ref: 0041EB5B
RegisterClassExW.USER32 ref: 0041EB6E
AdjustWindowRect.USER32 ref: 0041EBA4
CreateWindowExW.USER32 ref: 0041EBDF
__CxxThrowException@8.LIBVCRUNTIME ref: 0041EC1F

Part of subcall function 00421BA4: RaiseException.KERNEL32(?,?,?,0042110A,?,?,?,?,?,?,?,?,0042110A,00417BA0,004759CC,00417BA0), ref: 00421C03

ShowWindow.USER32(00000000,0000000A), ref: 0041EC38
UpdateWindow.USER32 ref: 0041EC44

Strings

@, xrefs: 0041EABD
Failed to get valid window handle., xrefs: 0041EBF2
MainWindow.cpp, xrefs: 0041EC09
Chili DirectX Framework, xrefs: 0041EBD1
d, xrefs: 0041EB87
0, xrefs: 0041EAB3

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Load$Image$AdjustClassCreateCursorExceptionException@8RaiseRectRegisterShowThrowUpdate
String ID: 0$@$Chili DirectX Framework$Failed to get valid window handle.$MainWindow.cpp$d
API String ID: 382242351-2674257117
Opcode ID: 3986d4dc80fc71200514dc016e33116c84dd3f4d2c4a65e3f461b07dca5b0708
Instruction ID: 9e8eb5d3673db8aaf568a1d1517c721a99a91f30b533de9fe8556a387f2de223
Opcode Fuzzy Hash: 3986d4dc80fc71200514dc016e33116c84dd3f4d2c4a65e3f461b07dca5b0708
Instruction Fuzzy Hash: BC613B74A00208EFEB14CFA5CC95B9EBBB5FB48704F20815DE505AB382CBB56A44CF58

Uniqueness

Uniqueness Score: -1.00%

Function 0042F95D, Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0042F9A1

Part of subcall function 0042F5D5: _free.LIBCMT ref: 0042F5F2
Part of subcall function 0042F5D5: _free.LIBCMT ref: 0042F604
Part of subcall function 0042F5D5: _free.LIBCMT ref: 0042F616
Part of subcall function 0042F5D5: _free.LIBCMT ref: 0042F628
Part of subcall function 0042F5D5: _free.LIBCMT ref: 0042F63A
Part of subcall function 0042F5D5: _free.LIBCMT ref: 0042F64C
Part of subcall function 0042F5D5: _free.LIBCMT ref: 0042F65E
Part of subcall function 0042F5D5: _free.LIBCMT ref: 0042F670
Part of subcall function 0042F5D5: _free.LIBCMT ref: 0042F682
Part of subcall function 0042F5D5: _free.LIBCMT ref: 0042F694
Part of subcall function 0042F5D5: _free.LIBCMT ref: 0042F6A6
Part of subcall function 0042F5D5: _free.LIBCMT ref: 0042F6B8
Part of subcall function 0042F5D5: _free.LIBCMT ref: 0042F6CA

_free.LIBCMT ref: 0042F996

Part of subcall function 00426E08: HeapFree.KERNEL32(00000000,00000000,?,0042F766,?,00000000,?,?,?,0042F78D,?,00000007,?,?,0042FAF4,?), ref: 00426E1E
Part of subcall function 00426E08: GetLastError.KERNEL32(?,?,0042F766,?,00000000,?,?,?,0042F78D,?,00000007,?,?,0042FAF4,?,?), ref: 00426E30

_free.LIBCMT ref: 0042F9B8
_free.LIBCMT ref: 0042F9CD
_free.LIBCMT ref: 0042F9D8
_free.LIBCMT ref: 0042F9FA
_free.LIBCMT ref: 0042FA0D
_free.LIBCMT ref: 0042FA1B
_free.LIBCMT ref: 0042FA26
_free.LIBCMT ref: 0042FA5E
_free.LIBCMT ref: 0042FA65
_free.LIBCMT ref: 0042FA82
_free.LIBCMT ref: 0042FA9A

Strings

0uG, xrefs: 0042FA88, 0042FA6C

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: 0uG
API String ID: 161543041-1641702658
Opcode ID: e605e8ffec8925772a971072b776208924e6084e9be3ad3f8e9b1575d9f236d0
Instruction ID: 839c9b7075ec158f0d9f28c04a5e568c2cb10d1ace15cbf1ba983e3bbb4a560a
Opcode Fuzzy Hash: e605e8ffec8925772a971072b776208924e6084e9be3ad3f8e9b1575d9f236d0
Instruction Fuzzy Hash: 38315B72700225AFDB20AA79F845B5B73F9AF00314FD2443BE059E6651DE78AD848758

Uniqueness

Uniqueness Score: -1.00%

Function 0042639A, Relevance: 21.4, APIs: 2, Strings: 10, Instructions: 403COMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000006,?,?,?,?,?,?,?,?,?,?,?,00000280,?,00000280), ref: 00426440
GetModuleFileNameW.KERNEL32(?,?,00000105,?,?,?,?,?,?,?,?,?,00000280,?,00000280), ref: 00426464

Strings

Assertion failed!, xrefs: 004263BE
For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts, xrefs: 004267A3
File: , xrefs: 0042650A
Expression: , xrefs: 004266FA
Line: , xrefs: 00426680
\, xrefs: 00426561
<program name unknown>, xrefs: 0042646E
..., xrefs: 004264BF, 004265DE, 00426630, 00426774, 004267F7, 0042682A
(Press Retry to debug the application - JIT must be enabled), xrefs: 004267CD
Program: , xrefs: 00426402

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: Module$FileHandleName
String ID: (Press Retry to debug the application - JIT must be enabled)$...$<program name unknown>$Assertion failed!$Expression: $File: $For information on how your program can cause an assertionfailure, see the Visual C++ documentation on asserts$Line: $Program: $\
API String ID: 4146042529-3261600717
Opcode ID: 45b4a6e35d19c3d99741e00703d435ccb378cc1ff298905a8d71a247d96cc9c4
Instruction ID: e78b934dde1500dd6a25f2159a0a664a5bb76ce204033580c628cca7cd9ab39e
Opcode Fuzzy Hash: 45b4a6e35d19c3d99741e00703d435ccb378cc1ff298905a8d71a247d96cc9c4
Instruction Fuzzy Hash: 64C14831B0023966CB246A26AD4AFBF3369DF55704F8505AAFD04D1202FB38DE91C5ED

Uniqueness

Uniqueness Score: -1.00%

Function 00429478, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0042948E

Part of subcall function 00426E08: HeapFree.KERNEL32(00000000,00000000,?,0042F766,?,00000000,?,?,?,0042F78D,?,00000007,?,?,0042FAF4,?), ref: 00426E1E
Part of subcall function 00426E08: GetLastError.KERNEL32(?,?,0042F766,?,00000000,?,?,?,0042F78D,?,00000007,?,?,0042FAF4,?,?), ref: 00426E30

_free.LIBCMT ref: 0042949A
_free.LIBCMT ref: 004294A5
_free.LIBCMT ref: 004294B0
_free.LIBCMT ref: 004294BB
_free.LIBCMT ref: 004294C6
_free.LIBCMT ref: 004294D1
_free.LIBCMT ref: 004294DC
_free.LIBCMT ref: 004294E7
_free.LIBCMT ref: 004294F5

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 04a696696024a7b3a7b9040cc1ff572ae31bdf17fc7299042ead5ba4fecfd6e7
Instruction ID: 8cbec1dbb3e1e27fd2eab3e424186d639109a719df1f956a2662624ad3cec877
Opcode Fuzzy Hash: 04a696696024a7b3a7b9040cc1ff572ae31bdf17fc7299042ead5ba4fecfd6e7
Instruction Fuzzy Hash: 0621A77AA10118AFCF01EF95D881DDE7FB8AF08344F8285AAF515AB521DB35DA44CB84

Uniqueness

Uniqueness Score: -1.00%

Function 0041C7D0, Relevance: 13.6, APIs: 9, Instructions: 110COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0041C862
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0041C871
char_traits.LIBCPMTD ref: 0041C883
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0041C8B3
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0041C8C2
char_traits.LIBCPMTD ref: 0041C8CE

Part of subcall function 0041C240: std::_Xinvalid_argument.LIBCPMT ref: 0041C24C

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0041C8DF
Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0041C8EE
char_traits.LIBCPMTD ref: 0041C8FA

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWork$char_traits$Xinvalid_argumentstd::_
String ID:
API String ID: 1132090743-0
Opcode ID: 49590e3bfb64c5ebc49f2f53952cd76f9517413deca34c48d01cd0812aaf92a1
Instruction ID: 9bdfe76f1311703b7cdc81034f057c093528e44829ccad14a6a4870e48fe5839
Opcode Fuzzy Hash: 49590e3bfb64c5ebc49f2f53952cd76f9517413deca34c48d01cd0812aaf92a1
Instruction Fuzzy Hash: 8441B670A4010DEFCB04EF95D9D1DEE7376AF88344B10815DF8165B266DB34AEA0DB94

Uniqueness

Uniqueness Score: -1.00%

Function 00429941, Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 004299CB

Strings

]SB, xrefs: 0042994B
]SB, xrefs: 00429957, 004299B0, 004299CA
]SB, xrefs: 00429B85

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: _strrchr
String ID: ]SB$]SB$]SB
API String ID: 3213747228-2945255695
Opcode ID: d389ed1a3824a0105868c5d6cfbdb29faaed918498e4f6cf89a4d3fce130c4c1
Instruction ID: fbe5c0e07522536741e748fcd7bb5fcb5104d9ecbf941f886289e72e39dcf9ea
Opcode Fuzzy Hash: d389ed1a3824a0105868c5d6cfbdb29faaed918498e4f6cf89a4d3fce130c4c1
Instruction Fuzzy Hash: 6FB14432B042A59FDB118F29E881BEFBFE5EF55340F55406BE845AB341D2389D42CB68

Uniqueness

Uniqueness Score: -1.00%

Function 0041A9E0, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 194COMMON

Download Yara Rule

APIs

swap.LIBCMTD ref: 0041AA14
swap.LIBCMTD ref: 0041AA35
swap.LIBCMTD ref: 0041AA56
swap.LIBCMTD ref: 0041AA8A
swap.LIBCMTD ref: 0041AAE3

Strings

OtA, xrefs: 0041AA1F, 0041AABA, 0041AB20, 0041AB49, 0041ABE0, 0041AB9E, 0041AACF, 0041AAF7, 0041AADB, 0041AA9E, 0041AA2D, 0041AA30, 0041AAA1, 0041AADE, 0041AAEB, 0041AAFA, 0041ABA1, 0041ABE3
OtA, xrefs: 0041A9EF

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: swap
String ID: OtA$OtA
API String ID: 630424929-3289504672
Opcode ID: 0a2961ad63eedfcc3b717f0e72ff5d6b4b03e0c6ab0e029153bef2da76982fe9
Instruction ID: 56d0fdd3ad14dff81fd584e60b0d652a3eac9507c862f4bb9382ed37500517a6
Opcode Fuzzy Hash: 0a2961ad63eedfcc3b717f0e72ff5d6b4b03e0c6ab0e029153bef2da76982fe9
Instruction Fuzzy Hash: DF71197690010CEBCB05DFD9D981CEEF7B9AF88300F14C689A915B7241EB34AB85CB55

Uniqueness

Uniqueness Score: -1.00%

Function 0042BDA6, Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 77COMMON

Download Yara Rule

Strings

73@, xrefs: 0042BDA8
ext-ms-, xrefs: 0042BE11
api-ms-, xrefs: 0042BDFD

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 73@$api-ms-$ext-ms-
API String ID: 0-1426218077
Opcode ID: e2683f4522f9c9c33ec34eda560f0a173b959d65e80a3a979b1f643476a6823a
Instruction ID: 177526a1229fee88e391ef9c14de2baeeda7a0e7d4321c9bebf53cd36dc970fb
Opcode Fuzzy Hash: e2683f4522f9c9c33ec34eda560f0a173b959d65e80a3a979b1f643476a6823a
Instruction Fuzzy Hash: 4C21F631F01235EBCB218665BC45BAB7764DB11BA0F634137EA15A7391D778EC0086ED

Uniqueness

Uniqueness Score: -1.00%

Function 0041AC00, Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 246COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 0041ACC1

Part of subcall function 00421BA4: RaiseException.KERNEL32(?,?,?,0042110A,?,?,?,?,?,?,?,?,0042110A,00417BA0,004759CC,00417BA0), ref: 00421C03

__CxxThrowException@8.LIBVCRUNTIME ref: 0041AF81

Strings

Mapping sysbuffer, xrefs: 0041AC87
Graphics.cpp, xrefs: 0041ACA0
Presenting back buffer, xrefs: 0041AF41
Graphics.cpp, xrefs: 0041AF5A

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: Exception@8Throw$ExceptionRaise
String ID: Graphics.cpp$Graphics.cpp$Mapping sysbuffer$Presenting back buffer
API String ID: 3476068407-2623328188
Opcode ID: 363d9482466aeb0e4c26b25e5c2a594d384529b53f5d72e3d3cd9798199de6f9
Instruction ID: b3e171053fc77c24a81dd06811e1e020583d503fb68bf97ee1c46fe7e3249c8f
Opcode Fuzzy Hash: 363d9482466aeb0e4c26b25e5c2a594d384529b53f5d72e3d3cd9798199de6f9
Instruction Fuzzy Hash: A2B11B70A01218DFEB14DB54CCA1FA9B3B5EF48704F0481DEE50AA7291DB746E84CF69

Uniqueness

Uniqueness Score: -1.00%

Function 0042F774, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0042F73C: _free.LIBCMT ref: 0042F761

_free.LIBCMT ref: 0042F7C2

Part of subcall function 00426E08: HeapFree.KERNEL32(00000000,00000000,?,0042F766,?,00000000,?,?,?,0042F78D,?,00000007,?,?,0042FAF4,?), ref: 00426E1E
Part of subcall function 00426E08: GetLastError.KERNEL32(?,?,0042F766,?,00000000,?,?,?,0042F78D,?,00000007,?,?,0042FAF4,?,?), ref: 00426E30

_free.LIBCMT ref: 0042F7CD
_free.LIBCMT ref: 0042F7D8
_free.LIBCMT ref: 0042F82C
_free.LIBCMT ref: 0042F837
_free.LIBCMT ref: 0042F842
_free.LIBCMT ref: 0042F84D

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 7df0b7d30e60dc1cdc3e9a16c8e03c47f06f6a0181f588900f1d0c8bcee7c7ad
Instruction ID: 222e35bb645915a48025e9b3b3175de67cfe02d0dbe9bc17fd012ce6c73bcc8e
Opcode Fuzzy Hash: 7df0b7d30e60dc1cdc3e9a16c8e03c47f06f6a0181f588900f1d0c8bcee7c7ad
Instruction Fuzzy Hash: 50117272640724B6DA20B772EC07FCBB7EC5F40704FC1083EB299A6052D678B5494794

Uniqueness

Uniqueness Score: -1.00%

Function 00423AC2, Relevance: 10.6, APIs: 7, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00423AB9,00421D00), ref: 00423AD0
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00423ADE
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00423AF7
SetLastError.KERNEL32(00000000,?,00423AB9,00421D00), ref: 00423B49

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: cce382363d9ff7c73395c597c42b8aa9c7809798eee7c5aaa85bd8772fab3d72
Instruction ID: 4654d652e61ffdaab195d331ae77d22421bf54356e44174c68e5b5f2b74f2a4a
Opcode Fuzzy Hash: cce382363d9ff7c73395c597c42b8aa9c7809798eee7c5aaa85bd8772fab3d72
Instruction Fuzzy Hash: ED01283231D2312DAA242F7A7C859172F75EB01B7B3A0023FF920941E2EE5D5E80E58C

Uniqueness

Uniqueness Score: -1.00%

Function 00432797, Relevance: 9.3, APIs: 6, Instructions: 317fileCOMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNEL32(?,00000000,?), ref: 004327DF
__fassign.LIBCMT ref: 004329C4
__fassign.LIBCMT ref: 004329E1
WriteFile.KERNEL32(?,?,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00432A29
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00432A69
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00432B11

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLastOutput
String ID:
API String ID: 1735259414-0
Opcode ID: c6397639eed041cde02c3bce62caab1c5faf0f3be46066e530ededc164a1f169
Instruction ID: f4cfde5620dfb74fca74d5575467a011484ab86e6aff2b4def5afa187d92d87d
Opcode Fuzzy Hash: c6397639eed041cde02c3bce62caab1c5faf0f3be46066e530ededc164a1f169
Instruction Fuzzy Hash: B4C18DB1E002589FCB14CFA8C980AEDFBB5AF08314F28516AE855F7341D675AD46CF68

Uniqueness

Uniqueness Score: -1.00%

Function 00429590, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,00000000,?,00424735,00000000,00000280,00000280,?,0042420E,?,00000280,00000000,00000280), ref: 00429595
_free.LIBCMT ref: 004295F2
_free.LIBCMT ref: 00429628
SetLastError.KERNEL32(00000000,00000006,000000FF,?,0042420E,?,00000280,00000000,00000280), ref: 00429633

Strings

ptG, xrefs: 0042961B

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID: ptG
API String ID: 2283115069-140237187
Opcode ID: 3613e018843d09b9ee30c9280e1ead826fe61c72d19e41432d34fa1cd3742eb9
Instruction ID: e3dd23ed38ec570f7e481650ea734a2fdbe030d0f94eaddf5322f01f4d0011ba
Opcode Fuzzy Hash: 3613e018843d09b9ee30c9280e1ead826fe61c72d19e41432d34fa1cd3742eb9
Instruction Fuzzy Hash: 9B110A733042317A9A1126BABC81E2B25999BC177CFF5023FF925962E1DE6D4C45912C

Uniqueness

Uniqueness Score: -1.00%

Function 004296E7, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00426DDE,00423F6C,?,?,00403337,?,00000000,Unknown error.), ref: 004296EC
_free.LIBCMT ref: 00429749
_free.LIBCMT ref: 0042977F
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,?,00426DDE,00423F6C,?,?,00403337,?,00000000,Unknown error.), ref: 0042978A

Strings

ptG, xrefs: 00429772

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID: ptG
API String ID: 2283115069-140237187
Opcode ID: 98ed41247a47a063e3f25bd7ecfbd3ad9e7a4938a8e9c556c9a724a54e047fc9
Instruction ID: 4dbfc119a151515224cffbc0378f2b3c7d8b874553cacaf8a86d58f63ef6d5ac
Opcode Fuzzy Hash: 98ed41247a47a063e3f25bd7ecfbd3ad9e7a4938a8e9c556c9a724a54e047fc9
Instruction Fuzzy Hash: 94110C72314230AADA102EFABCC5D2B2559A7C177CFF5013BF929971E1DD298C05A12C

Uniqueness

Uniqueness Score: -1.00%

Function 00426927, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,?,394BD140), ref: 00426947
GetFileType.KERNEL32(00000000,?,394BD140), ref: 00426959
swprintf.LIBCMT ref: 0042697A
WriteConsoleW.KERNEL32(00000000,?,?,?,00000000,?,?,?,?,394BD140), ref: 004269B7

Strings

Assertion failed: %Ts, file %Ts, line %d, xrefs: 0042696F

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleFileHandleTypeWriteswprintf
String ID: Assertion failed: %Ts, file %Ts, line %d
API String ID: 2943507729-1719349581
Opcode ID: 7dd2bf56deea3f70fa6f004f2502a6e7355f440e127d97a6622c17d7f6bc8199
Instruction ID: 3a3e78815c617507f6ceef1b479aede6e369b3da9ddbd2ba028e8651fd52ac32
Opcode Fuzzy Hash: 7dd2bf56deea3f70fa6f004f2502a6e7355f440e127d97a6622c17d7f6bc8199
Instruction Fuzzy Hash: 6A1138B16001296BCB109F25EC859EF73B8DF84310F92466AF91593140DE34AD85CB6C

Uniqueness

Uniqueness Score: -1.00%

Function 0041F2E0, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32 ref: 0041F321
SetWindowLongW.USER32 ref: 0041F332
DefWindowProcW.USER32(?,00000081,?,?), ref: 0041F362

Strings

pWnd != nullptr, xrefs: 0041F30A
MainWindow.cpp, xrefs: 0041F305

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Long$Proc
String ID: MainWindow.cpp$pWnd != nullptr
API String ID: 3468714886-2106364061
Opcode ID: b4ddf11ff44fece48a57ee6dbcf278d8be88b404bdf085da904fe7053cb2d916
Instruction ID: b23c38835bb4f3bec82dbdb43a6411e308bf9ea8e8bfda8d7e1693587465f5c7
Opcode Fuzzy Hash: b4ddf11ff44fece48a57ee6dbcf278d8be88b404bdf085da904fe7053cb2d916
Instruction Fuzzy Hash: B2112E75604108BBCB04CF98DC85DAE77B9AB88710F10C219FA1997290D734AA55DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00427AFB, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00427AAD,?,?,00427A75,00000000,00000280,?), ref: 00427B10
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00427B23
FreeLibrary.KERNEL32(00000000,?,?,00427AAD,?,?,00427A75,00000000,00000280,?), ref: 00427B46

Strings

mscoree.dll, xrefs: 00427B09
CorExitProcess, xrefs: 00427B1B

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 8eb2339d550289567f6bb96d2958a922e3e0535edf93105cb3815401fd2a989a
Instruction ID: 3eae13791708391ae32af328fb2b414c7dd3ee65f312a02359c3887fb8d207dc
Opcode Fuzzy Hash: 8eb2339d550289567f6bb96d2958a922e3e0535edf93105cb3815401fd2a989a
Instruction Fuzzy Hash: 7AF0A731601129FBDF11AB91EC0AF9EBF78EF4175AF114071F401A22A1DB758E40DB98

Uniqueness

Uniqueness Score: -1.00%

Function 004281C5, Relevance: 7.6, APIs: 5, Instructions: 119COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00428233
_free.LIBCMT ref: 00428253
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 004282B4
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 004282C6
__crt_fast_encode_pointer.LIBVCRUNTIME ref: 004282D3

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: __crt_fast_encode_pointer$_free
String ID:
API String ID: 366466260-0
Opcode ID: 7f1442af4a65d854efeac96dcacb771ee0b8bfbcef6520ace1c1994799109450
Instruction ID: aaec7135f8725290225e9c3d8d803c53124d6a0f326ef49418d642b53b81b08f
Opcode Fuzzy Hash: 7f1442af4a65d854efeac96dcacb771ee0b8bfbcef6520ace1c1994799109450
Instruction Fuzzy Hash: 4241D432B01624DFDB14DF68D881A5EB7F6EF89304B9544AEE505EB342DA34ED01CB94

Uniqueness

Uniqueness Score: -1.00%

Function 0042F6D3, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0042F6EB

Part of subcall function 00426E08: HeapFree.KERNEL32(00000000,00000000,?,0042F766,?,00000000,?,?,?,0042F78D,?,00000007,?,?,0042FAF4,?), ref: 00426E1E
Part of subcall function 00426E08: GetLastError.KERNEL32(?,?,0042F766,?,00000000,?,?,?,0042F78D,?,00000007,?,?,0042FAF4,?,?), ref: 00426E30

_free.LIBCMT ref: 0042F6FD
_free.LIBCMT ref: 0042F70F
_free.LIBCMT ref: 0042F721
_free.LIBCMT ref: 0042F733

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: c384fff509b51c659bf805f77d6bd4651abac9339d4ecf9ec3c9b6efd293d21f
Instruction ID: c5dd6472e5b57ae8835e2716c0a56ed9fc7902bea66302fc0c6e33160f941d30
Opcode Fuzzy Hash: c384fff509b51c659bf805f77d6bd4651abac9339d4ecf9ec3c9b6efd293d21f
Instruction Fuzzy Hash: FCF0E136618224A78910DB55F5C5C1773EDAB447547D6083AF858D7A11CB38FD848A9C

Uniqueness

Uniqueness Score: -1.00%

Function 0042C467, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 0042C61D

Part of subcall function 00426E42: RtlAllocateHeap.NTDLL(00000000,00000000,?,?,00420759,00000000,?,00417BA0,00000000,?,00000000), ref: 00426E74

__freea.LIBCMT ref: 0042C626
__freea.LIBCMT ref: 0042C649

Strings

WB, xrefs: 0042C479

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: __freea$AllocateHeap
String ID: WB
API String ID: 2243444508-3317103820
Opcode ID: 364163e73d36b014a8239a9c5e85e53cc0979aebbf4bba436515764c022b18b8
Instruction ID: a33439aa16d09d56179414478275aeef42c6a40cc587c21fa8c81d0fb6448a45
Opcode Fuzzy Hash: 364163e73d36b014a8239a9c5e85e53cc0979aebbf4bba436515764c022b18b8
Instruction Fuzzy Hash: 2251F272700236BFDB209F65EC81EBF36A9EF44354F99012AFC04A7250DB78DC4196A9

Uniqueness

Uniqueness Score: -1.00%

Function 00427BCD, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\Orderpdf.exe, xrefs: 00427C0B, 00427C12, 00427C46

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Users\user\Desktop\Orderpdf.exe
API String ID: 0-1051190819
Opcode ID: d17e2452bcea97a032948bac632fe4e760e7ee5477c36b07de9f2bc1e8f628e4
Instruction ID: 2950be8a0dbe533367bfbc9f45a9e535d61a4678c64449175734f6bfddd11c63
Opcode Fuzzy Hash: d17e2452bcea97a032948bac632fe4e760e7ee5477c36b07de9f2bc1e8f628e4
Instruction Fuzzy Hash: 72319571B44224AFCB21DFAAEC8599FBBB8EB94310B91006BF405D7350D6749E41CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E3C0, Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::GetWorkQueueIdentity.LIBCMTD ref: 0041E3CD
construct.LIBCPMTD ref: 0041E4DF

Part of subcall function 0041D7A0: shared_ptr.LIBCMTD ref: 0041D7B6

Strings

lA, xrefs: 0041E49F, 0041E4A2
lA, xrefs: 0041E473, 0041E4C2, 0041E499

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: Base::Concurrency::details::ContextIdentityQueueWorkconstructshared_ptr
String ID: lA$lA
API String ID: 2097479137-530826692
Opcode ID: d97fedfad9623b7d896bcb33eda59cbc3cd077ee2b4de7ac8b9bb414f4f496ac
Instruction ID: c7c91748c59545101ddddd9461fa47af8ae8a35602c6db75175a8168bde50a0c
Opcode Fuzzy Hash: d97fedfad9623b7d896bcb33eda59cbc3cd077ee2b4de7ac8b9bb414f4f496ac
Instruction Fuzzy Hash: B4410074E04118EFCB18EF65C992AEEB7B2AF89304F1444ADE4066B355DB346E40DB88

Uniqueness

Uniqueness Score: -1.00%

Function 0041EF00, Relevance: 6.2, APIs: 4, Instructions: 244windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041EF7F
SetCapture.USER32(?,?,?), ref: 0041F03D
DefWindowProcW.USER32(?,?,?,00000009), ref: 0041F211

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: CaptureMessagePostProcQuitWindow
String ID:
API String ID: 139009503-0
Opcode ID: ae0bc7bd891e654ca8b348a73d5b3c51a1738bad9effb3ae8bee7c33389f8b08
Instruction ID: 519c3c4fd6f800e5266d5be408a2b49c24288e9f4325c429355e8707167ca9e0
Opcode Fuzzy Hash: ae0bc7bd891e654ca8b348a73d5b3c51a1738bad9effb3ae8bee7c33389f8b08
Instruction Fuzzy Hash: 5391A17990051AEBCF08DFD9C8909FFB3B5BF88705F10406EE91267241D63D9A86C76A

Uniqueness

Uniqueness Score: -1.00%

Function 00417100, Relevance: 6.2, APIs: 4, Instructions: 232COMMON

Download Yara Rule

APIs

Part of subcall function 00417480: _Smanip.LIBCPMTD ref: 00417605

Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 004172AE
_Enable_shared_from_this.LIBCPMTD ref: 00417367
Concurrency::details::HardwareAffinity::operator!=.LIBCMTD ref: 0041737C
_Enable_shared_from_this.LIBCPMTD ref: 004173A8

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: Affinity::operator!=Concurrency::details::Enable_shared_from_thisHardware$Smanip
String ID:
API String ID: 3711939271-0
Opcode ID: 7fa6576104a7d54cfe7445b96f513cbf1bc7a16b9879982d3da0a27cdce43772
Instruction ID: a195994453d583df5c24e8be6dd062c7f1679b51ace9054a354fdfd947d68bb6
Opcode Fuzzy Hash: 7fa6576104a7d54cfe7445b96f513cbf1bc7a16b9879982d3da0a27cdce43772
Instruction Fuzzy Hash: 95918171D40219ABCB14EB51CC92FEDB375AF58304F0181AEB41A66191EF786BC8CF98

Uniqueness

Uniqueness Score: -1.00%

Function 00417B00, Relevance: 6.1, APIs: 4, Instructions: 59COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00417B28
Concurrency::cancel_current_task.LIBCPMT ref: 00417B59
new.LIBCMT ref: 00417B62

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: e345d996862a17fe442d44bde9808ea64ae5f59d1bfe556a356278a40525fb65
Instruction ID: 50a89dc29735f894780d56be71951284ba4c67059bc5b8175935d4b6b81f1499
Opcode Fuzzy Hash: e345d996862a17fe442d44bde9808ea64ae5f59d1bfe556a356278a40525fb65
Instruction Fuzzy Hash: DF215EB0E0811CEBDF14DFA9D5817DDBBB1AF44308F10859AE8155B385D378AB80CB89

Uniqueness

Uniqueness Score: -1.00%

Function 00422A5A, Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00422A71

Part of subcall function 004230A9: ___BuildCatchObjectHelper.LIBVCRUNTIME ref: 004230D8
Part of subcall function 004230A9: ___AdjustPointer.LIBCMT ref: 004230F3

_UnwindNestedFrames.LIBCMT ref: 00422A88
___FrameUnwindToState.LIBVCRUNTIME ref: 00422A9A
CallCatchBlock.LIBVCRUNTIME ref: 00422ABE

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: 11750c8de5c21044b4d5d5d28c79b72a418e2519a4bfae3031c7571e23868219
Instruction ID: 7325a7b4ccb8076b07e8fad0b756eff019459657794ce11a49c4f283a47c7da4
Opcode Fuzzy Hash: 11750c8de5c21044b4d5d5d28c79b72a418e2519a4bfae3031c7571e23868219
Instruction Fuzzy Hash: 88016932200119FBCF229F56ED01EDA3BBAFF58714F40411AF91861121C3BAE861DBA8

Uniqueness

Uniqueness Score: -1.00%

Function 004349B5, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,00000000,?,004344C3,00000000,00000001,00000000,00000000,?,00432B6E,?,?,00000000), ref: 004349CC
GetLastError.KERNEL32(?,004344C3,00000000,00000001,00000000,00000000,?,00432B6E,?,?,00000000,?,00000000,?,004330BA,?), ref: 004349D8

Part of subcall function 0043499E: CloseHandle.KERNEL32(FFFFFFFE,004349E8,?,004344C3,00000000,00000001,00000000,00000000,?,00432B6E,?,?,00000000,?,00000000), ref: 004349AE

___initconout.LIBCMT ref: 004349E8

Part of subcall function 00434960: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0043498F,004344B0,00000000,?,00432B6E,?,?,00000000,?), ref: 00434973

WriteConsoleW.KERNEL32(00000000,?,00000000,00000000,?,004344C3,00000000,00000001,00000000,00000000,?,00432B6E,?,?,00000000,?), ref: 004349FD

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 205ba19c6dd12d593b86091b3510229aa3d02643df7c9e973d829fe36a563316
Instruction ID: 978ce92bfae406ea776dfc930a84a724f2587cb40d5b56782b555a73a3ad91bd
Opcode Fuzzy Hash: 205ba19c6dd12d593b86091b3510229aa3d02643df7c9e973d829fe36a563316
Instruction Fuzzy Hash: 63F01C36100269BBCF626FA1DC05ADA3F26EF497A0F025025FA1895120C6369860DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00423756, Relevance: 6.0, APIs: 4, Instructions: 14COMMON

Download Yara Rule

APIs

___vcrt_initialize_pure_virtual_call_handler.LIBVCRUNTIME ref: 00423756
___vcrt_initialize_winapi_thunks.LIBVCRUNTIME ref: 0042375B
___vcrt_initialize_locks.LIBVCRUNTIME ref: 00423760

Part of subcall function 00423D9E: ___vcrt_InitializeCriticalSectionEx.LIBVCRUNTIME ref: 00423DAF

___vcrt_uninitialize_locks.LIBVCRUNTIME ref: 00423775

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalInitializeSection___vcrt____vcrt_initialize_locks___vcrt_initialize_pure_virtual_call_handler___vcrt_initialize_winapi_thunks___vcrt_uninitialize_locks
String ID:
API String ID: 1761009282-0
Opcode ID: f56f0aa564f8babbb0b296736aa8987dd784912f7ed8191d29c014747552c40c
Instruction ID: 9533fa3cb51d7c81f12200da83002b03c3f46d96bd7119e8d5f3254a92261673
Opcode Fuzzy Hash: f56f0aa564f8babbb0b296736aa8987dd784912f7ed8191d29c014747552c40c
Instruction Fuzzy Hash: 4DC002C4310235545D243EB732132AA273008A6B8FFC0A0CBB84017203598D674A162E

Uniqueness

Uniqueness Score: -1.00%

Function 0042EB32, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 126COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(0000FDE9,?,0000000C,00000000,00000000), ref: 0042EB64

Strings

, xrefs: 0042EBA9
WB, xrefs: 0042EB49

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: Info
String ID: $WB
API String ID: 1807457897-3447237139
Opcode ID: 72ac027f3e410bb9e32df7df3ca0f6e1c1962a2eab7309ed26029c34d3be4275
Instruction ID: 5f2a8cc915b6ab95616a0187e05eb8ec14aa7333d8da67c925168175084319a8
Opcode Fuzzy Hash: 72ac027f3e410bb9e32df7df3ca0f6e1c1962a2eab7309ed26029c34d3be4275
Instruction Fuzzy Hash: 37416D703042689BDB21CB56DD84BFB7BEDDB41304FA404AEE58A87142D238AA45DB18

Uniqueness

Uniqueness Score: -1.00%

Function 0042C364, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,0000FDE9), ref: 0042C434
__freea.LIBCMT ref: 0042C43D

Part of subcall function 00426E42: RtlAllocateHeap.NTDLL(00000000,00000000,?,?,00420759,00000000,?,00417BA0,00000000,?,00000000), ref: 00426E74

Strings

WB, xrefs: 0042C377

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeapStringType__freea
String ID: WB
API String ID: 4073780324-3317103820
Opcode ID: 09494e36096b5a5df9b5feec6663145271dec68f68c8b14506c4b152ba5c5eda
Instruction ID: 4c6112177eca29bf7d06e268cb562422d12c1f5d18bb3c3ff4568b445b49b7f9
Opcode Fuzzy Hash: 09494e36096b5a5df9b5feec6663145271dec68f68c8b14506c4b152ba5c5eda
Instruction Fuzzy Hash: DA31F771A0022AABDB20AF65EC81DBF7BB5EF44314F85412AFC0497252D7388D51C798

Uniqueness

Uniqueness Score: -1.00%

Function 0042BE6D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

Strings

73@, xrefs: 0042BEA7

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 73@
API String ID: 0-1557270183
Opcode ID: db7b80e7d16ce53f8f96ba016f69fd0321242c6be28dbd84eeced511f9afc6b2
Instruction ID: fc2022ca4b9170780014759a0e3415e3b7cb2c4142f9829995d1a6d5e4c01520
Opcode Fuzzy Hash: db7b80e7d16ce53f8f96ba016f69fd0321242c6be28dbd84eeced511f9afc6b2
Instruction Fuzzy Hash: F101D2337042255BAB26CE29FC4099B339AEBC13207A68126FA04CB285DB348841D6D8

Uniqueness

Uniqueness Score: -1.00%

Function 0042964D, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0042969D
_free.LIBCMT ref: 004296D1

Strings

ptG, xrefs: 004296C4

Memory Dump Source

Source File: 00000000.00000002.204544069.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.204537289.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204617520.0000000000436000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204759960.0000000000477000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.204766820.0000000000478000.00000004.00020000.sdmp Download File
Associated: 00000000.00000002.204776115.0000000000479000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204789592.000000000047B000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204794429.000000000047F000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204805686.000000000048C000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.204812636.0000000000497000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID: ptG
API String ID: 269201875-140237187
Opcode ID: ea3c4376d50f7c3a8c63493beb648c5e41bddc88b83b4541a4996c72ed0bc387
Instruction ID: ea0e91b79eba3ae727faa0ed679ae9ea6a870f707ed949e44ca2fd378b732e2b
Opcode Fuzzy Hash: ea3c4376d50f7c3a8c63493beb648c5e41bddc88b83b4541a4996c72ed0bc387
Instruction Fuzzy Hash: 8301A73270963166DA2536BABC42F6F15885F01728FE6022BBC24B92E1D91C8C61A5ED

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: MSBuild.exe PID: 6004 Parent PID: 528 MSBuild.exeCOMMON

Executed Functions

Function 02A31860, Relevance: 2.7, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

hV, xrefs: 02A31A01
</kr, xrefs: 02A318BC

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID: </kr$hV
API String ID: 0-2505177940
Opcode ID: 48101f21063e2d41efbb7c0d01c8f9bce61ebc406dc5fea6b5240994a26c759a
Instruction ID: d9ec958333a6fab4b778d44a9ec338a53aa1bdc501f74eb353ae20877df18e1e
Opcode Fuzzy Hash: 48101f21063e2d41efbb7c0d01c8f9bce61ebc406dc5fea6b5240994a26c759a
Instruction Fuzzy Hash: 1171F6317042458FC702DF69C894BAE7BF6EF85310F0984AAE459DB2A1DB30ED49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02A31DF8, Relevance: 1.6, Strings: 1, Instructions: 384COMMON

Download Yara Rule

Strings

</kr, xrefs: 02A31FD9

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID: </kr
API String ID: 0-2427075492
Opcode ID: 1d59d86896e4034427ea4a176e0adf2229a9fafec4db2e49510eba0f7be384ca
Instruction ID: c8b6cb51d5eed36234ff0d79fce1c2c939a25db0c54daa1905adcd314d6266e4
Opcode Fuzzy Hash: 1d59d86896e4034427ea4a176e0adf2229a9fafec4db2e49510eba0f7be384ca
Instruction Fuzzy Hash: 2DF17E30600205CFCB15DB69C884B6ABBF6EF85310F5685A9E8099B269DF70FD49CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00CAA533, Relevance: 1.6, APIs: 1, Instructions: 98fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00CAA5E9

Memory Dump Source

Source File: 00000004.00000002.213583036.0000000000CAA000.00000040.00000001.sdmp, Offset: 00CAA000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2cfee12dbcd02255ea0f3a62f7fa1de27078e79338e61dab81066b9a161cf2a2
Instruction ID: e80eeefc03b110897ba5794c9de22bf665b217c6e5e8eee4ee5bca5809995d25
Opcode Fuzzy Hash: 2cfee12dbcd02255ea0f3a62f7fa1de27078e79338e61dab81066b9a161cf2a2
Instruction Fuzzy Hash: 71317EB2505380AFE722CF65DC44F66BFE8EF46714F08849AE9848B252D375E909CB71

Uniqueness

Uniqueness Score: -1.00%

Function 00CAA640, Relevance: 1.6, APIs: 1, Instructions: 80COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,D64F0B1A,00000000,00000000,00000000,00000000), ref: 00CAA6D5

Memory Dump Source

Source File: 00000004.00000002.213583036.0000000000CAA000.00000040.00000001.sdmp, Offset: 00CAA000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 9d1c9f0ff49a81fae533b1093b8593185df64b71cbfbf53570145e63ccbded4c
Instruction ID: 50678cbb51ae3411cb0fc61c27b9a6e0349ea905cf6981bc57d171d1c566d452
Opcode Fuzzy Hash: 9d1c9f0ff49a81fae533b1093b8593185df64b71cbfbf53570145e63ccbded4c
Instruction Fuzzy Hash: F421D6B64093806FE7128B25DC41FA2BFB8EF47720F1884D7EE848B293D2646909C771

Uniqueness

Uniqueness Score: -1.00%

Function 00CAA56A, Relevance: 1.6, APIs: 1, Instructions: 76fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 00CAA5E9

Memory Dump Source

Source File: 00000004.00000002.213583036.0000000000CAA000.00000040.00000001.sdmp, Offset: 00CAA000, based on PE: false

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: d4429a98069fe31d10b81d6ddc45b2dfc782923e503842b2a805618f473ff4f0
Instruction ID: 06d8e67cf6423a134ffcf7b5c1298f4ace2849801cb89230de066275b617a4da
Opcode Fuzzy Hash: d4429a98069fe31d10b81d6ddc45b2dfc782923e503842b2a805618f473ff4f0
Instruction Fuzzy Hash: 1F218E71500600AFEB21DF66CC44F66FBE8EF05724F18846AE9858B251D771E905CB76

Uniqueness

Uniqueness Score: -1.00%

Function 00CAA710, Relevance: 1.6, APIs: 1, Instructions: 75fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,D64F0B1A,00000000,00000000,00000000,00000000), ref: 00CAA7A1

Memory Dump Source

Source File: 00000004.00000002.213583036.0000000000CAA000.00000040.00000001.sdmp, Offset: 00CAA000, based on PE: false

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 942f4a29280c93107143921bb7d527a64104f48c58677703f58e803707ba629c
Instruction ID: 33beddeac719e0d4db93893db91deba44470ed3a7ccd5df68ecc11d8f97368a4
Opcode Fuzzy Hash: 942f4a29280c93107143921bb7d527a64104f48c58677703f58e803707ba629c
Instruction Fuzzy Hash: BC21A172409384AFE7228F65DC44F56FFB8EF46314F08849BEA859B153C265A909CB72

Uniqueness

Uniqueness Score: -1.00%

Function 00CAAC1C, Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

VerLanguageNameW.KERNELBASE(?,00000E2C,?,?), ref: 00CAACB2

Memory Dump Source

Source File: 00000004.00000002.213583036.0000000000CAA000.00000040.00000001.sdmp, Offset: 00CAA000, based on PE: false

Similarity

API ID: LanguageName
String ID:
API String ID: 2060303382-0
Opcode ID: 251f273d118fef886bd8c4938e7bbc82555cfe43969c0f3c3ad5c6b607425212
Instruction ID: 4cb9f68634831f5a59ffa096ec218894887191368d0dc1c3b6586e8b3cca9ae6
Opcode Fuzzy Hash: 251f273d118fef886bd8c4938e7bbc82555cfe43969c0f3c3ad5c6b607425212
Instruction Fuzzy Hash: F72195754097806FD3138B25DC51B62BFB4EF87B20F0981DBE8848B653D224A919C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 00CAA7EB, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,?), ref: 00CAA863

Memory Dump Source

Source File: 00000004.00000002.213583036.0000000000CAA000.00000040.00000001.sdmp, Offset: 00CAA000, based on PE: false

Similarity

API ID: FileInfoSizeVersion
String ID:
API String ID: 1661704012-0
Opcode ID: db8a5d910d2b347280796f52c7a3f4fabb03b22e1fb6f1335b30ecdcb033c504
Instruction ID: c145ddad8d4efbc9c6b716dc2039c1c29c2df8596a29bcaa2e125146892d0dd7
Opcode Fuzzy Hash: db8a5d910d2b347280796f52c7a3f4fabb03b22e1fb6f1335b30ecdcb033c504
Instruction Fuzzy Hash: BB21DE714083C45FD712CB65DC45B92BFE8EF02314F0980EADD848F253D3649909CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CAA336, Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00CAA39C

Memory Dump Source

Source File: 00000004.00000002.213583036.0000000000CAA000.00000040.00000001.sdmp, Offset: 00CAA000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 05ee08fd0a8f3eb70636b6c8205b830245f726d7e7ba9902b2e1d1758ff312bd
Instruction ID: 4f11a9157f4bf3cd2c2164fc19988ae7719e0a03b222908d1e089c5a520dbb60
Opcode Fuzzy Hash: 05ee08fd0a8f3eb70636b6c8205b830245f726d7e7ba9902b2e1d1758ff312bd
Instruction Fuzzy Hash: 0E218C7550A3C4AFD7128F24DC44A52BFB4EF43220F0984EBDD858F263C278A948CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CAA1F4, Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNELBASE ref: 00CAA269

Memory Dump Source

Source File: 00000004.00000002.213583036.0000000000CAA000.00000040.00000001.sdmp, Offset: 00CAA000, based on PE: false

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: 42080498870b5345e388686260704d54e172b8231770a6d51efd77877dec85f3
Instruction ID: b5100f2fa265b0a4ac4b2279b5605a25627ca3c8bbcaabd7fc43db4e48711d1e
Opcode Fuzzy Hash: 42080498870b5345e388686260704d54e172b8231770a6d51efd77877dec85f3
Instruction Fuzzy Hash: 19218C3540D3C49FC7138B65CC95A42BFB4EF03220F0A81DBD9848F2A3C369A908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CAA742, Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,D64F0B1A,00000000,00000000,00000000,00000000), ref: 00CAA7A1

Memory Dump Source

Source File: 00000004.00000002.213583036.0000000000CAA000.00000040.00000001.sdmp, Offset: 00CAA000, based on PE: false

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 9a284f2e61e99875ad112746a208f44d3e9a842d23b1c685db6cdab400bab2d5
Instruction ID: 68bc3bbc45c234c4da9c5e5906ffe04974c2f464b7e7d2a020319dbd50cf9876
Opcode Fuzzy Hash: 9a284f2e61e99875ad112746a208f44d3e9a842d23b1c685db6cdab400bab2d5
Instruction Fuzzy Hash: 73119D71400204AFEB21CF55DC80F6BFBA8EF45724F14886BEA459A251C275A508CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 00CAA8B4, Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

GetFileVersionInfoW.KERNELBASE(?,?,?,?), ref: 00CAA919

Memory Dump Source

Source File: 00000004.00000002.213583036.0000000000CAA000.00000040.00000001.sdmp, Offset: 00CAA000, based on PE: false

Similarity

API ID: FileInfoVersion
String ID:
API String ID: 2427832333-0
Opcode ID: 252b8eb30ee6d0fa610d0d16faa856314d339d3fca793500270bdf4157e7f1dc
Instruction ID: e2d48010367351bde51f50d1ce1bff92b5011a6c1fee20f4deba8216a344049f
Opcode Fuzzy Hash: 252b8eb30ee6d0fa610d0d16faa856314d339d3fca793500270bdf4157e7f1dc
Instruction Fuzzy Hash: 19119372504384AFDB218F25DC44F63FFB8EF56724F09809EED858B652D261E908CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CAA3E3, Relevance: 1.6, APIs: 1, Instructions: 57COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00CAA448

Memory Dump Source

Source File: 00000004.00000002.213583036.0000000000CAA000.00000040.00000001.sdmp, Offset: 00CAA000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: f39853f545c9ee3f4ab856a715ab11416c167e06bb2f0d908ac122c9883ff1b2
Instruction ID: f88d110398bd2f976ae194a9bf73f4c6d7b65ed8c360c15544a9d66a00dbcb0f
Opcode Fuzzy Hash: f39853f545c9ee3f4ab856a715ab11416c167e06bb2f0d908ac122c9883ff1b2
Instruction Fuzzy Hash: 7511BE714093C46FD7128B21DC44A51BFB49F07214F0980CBED858B263D2696909C762

Uniqueness

Uniqueness Score: -1.00%

Function 00CAA682, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,D64F0B1A,00000000,00000000,00000000,00000000), ref: 00CAA6D5

Memory Dump Source

Source File: 00000004.00000002.213583036.0000000000CAA000.00000040.00000001.sdmp, Offset: 00CAA000, based on PE: false

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 0f98b78f48fdef50a3f4e8b89c08504802b742a337b11333032038d314cb81a9
Instruction ID: 880b23acbaa722dc1b8051d86093648b79e54fa02808eacc671a2709ea650411
Opcode Fuzzy Hash: 0f98b78f48fdef50a3f4e8b89c08504802b742a337b11333032038d314cb81a9
Instruction Fuzzy Hash: E901D271500604AEE720DF16DC85F67FBA8EF46724F188097EE459B241D6B4A908CAB2

Uniqueness

Uniqueness Score: -1.00%

Function 00CAA8D6, Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

GetFileVersionInfoW.KERNELBASE(?,?,?,?), ref: 00CAA919

Memory Dump Source

Source File: 00000004.00000002.213583036.0000000000CAA000.00000040.00000001.sdmp, Offset: 00CAA000, based on PE: false

Similarity

API ID: FileInfoVersion
String ID:
API String ID: 2427832333-0
Opcode ID: b75a21f75f9877de2541b9b913e4bb3da3ae28fe2652afbc8e7a379eae38479f
Instruction ID: 11d33a510fe6bf7c3d7c21678f34f54b09db29e8b274178a2d84dfe701db187d
Opcode Fuzzy Hash: b75a21f75f9877de2541b9b913e4bb3da3ae28fe2652afbc8e7a379eae38479f
Instruction Fuzzy Hash: 0F0180716006059FDB208F26D844B67FBE4EF15724F18C06ADD458B652D371E508DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CAA826, Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetFileVersionInfoSizeW.KERNELBASE(?,?), ref: 00CAA863

Memory Dump Source

Source File: 00000004.00000002.213583036.0000000000CAA000.00000040.00000001.sdmp, Offset: 00CAA000, based on PE: false

Similarity

API ID: FileInfoSizeVersion
String ID:
API String ID: 1661704012-0
Opcode ID: 3708838c69a00ba2f6ff7e07a7e350a64c09059eb7d36ff8ffa8d92ace742cf4
Instruction ID: 2c87cfcb7c7ae03901b67aa87ba0eb8c99e85ed3ca1c4cdf59d0ea0a700997a4
Opcode Fuzzy Hash: 3708838c69a00ba2f6ff7e07a7e350a64c09059eb7d36ff8ffa8d92ace742cf4
Instruction Fuzzy Hash: 6201B1719002059FDB10CF56D884756FFD4EF45324F18C4AADD498B346D378E905CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CAA36A, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 00CAA39C

Memory Dump Source

Source File: 00000004.00000002.213583036.0000000000CAA000.00000040.00000001.sdmp, Offset: 00CAA000, based on PE: false

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: b6296bd970b5008a6f61b91d57ac2dc3e97bf9d09fb4ac211f07eba5788bb98c
Instruction ID: 066f68e42eaaca3715bdc3c2be0d15b73274103ee54281a89088387aa5604f1b
Opcode Fuzzy Hash: b6296bd970b5008a6f61b91d57ac2dc3e97bf9d09fb4ac211f07eba5788bb98c
Instruction Fuzzy Hash: 2D01DF75501244DFDB108F2AD884766FF94EF41324F18C4ABDD098F212D7B4E808DB62

Uniqueness

Uniqueness Score: -1.00%

Function 00CAAC62, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

VerLanguageNameW.KERNELBASE(?,00000E2C,?,?), ref: 00CAACB2

Memory Dump Source

Source File: 00000004.00000002.213583036.0000000000CAA000.00000040.00000001.sdmp, Offset: 00CAA000, based on PE: false

Similarity

API ID: LanguageName
String ID:
API String ID: 2060303382-0
Opcode ID: 50708e306661e51a3668433a9e55ee386d9f1a08735838c3428aad4cb4646df5
Instruction ID: caec40233b4868b5e5fdc189ab69c0d0399b3d3e9fdd662eec77acc3be795dab
Opcode Fuzzy Hash: 50708e306661e51a3668433a9e55ee386d9f1a08735838c3428aad4cb4646df5
Instruction Fuzzy Hash: 70016276500604ABD210DF16DC86F26FBA8FBC8B20F14815AED085B741E371F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00CAA416, Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 00CAA448

Memory Dump Source

Source File: 00000004.00000002.213583036.0000000000CAA000.00000040.00000001.sdmp, Offset: 00CAA000, based on PE: false

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 6e6854d7c987c11efc8764166cd8f61ef4a2ba3f61079655d6ac42fd938d7d61
Instruction ID: 234ed533795c23611c0ce78bc89784df89d8df96f83f2d4301476bec1f1c20e6
Opcode Fuzzy Hash: 6e6854d7c987c11efc8764166cd8f61ef4a2ba3f61079655d6ac42fd938d7d61
Instruction Fuzzy Hash: 82F0AF34500644DFDB20CF16D889762FFA4EF09724F18D4ABED494B316D3B9A948CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 00CAA23A, Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetConsoleOutputCP.KERNELBASE ref: 00CAA269

Memory Dump Source

Source File: 00000004.00000002.213583036.0000000000CAA000.00000040.00000001.sdmp, Offset: 00CAA000, based on PE: false

Similarity

API ID: ConsoleOutput
String ID:
API String ID: 3985236979-0
Opcode ID: 71242e4f28293e164ce43b64ed5b4c19da6faef8776c3bbd308cc84ed717c14a
Instruction ID: 5943547437ef4e0ab8367d7b3dc4b52423918ddec84501a9f804478bf4da7348
Opcode Fuzzy Hash: 71242e4f28293e164ce43b64ed5b4c19da6faef8776c3bbd308cc84ed717c14a
Instruction Fuzzy Hash: 5CF0AF319046449FDB108F56D884762FF90EF45724F18C1AADD094B316D3BAA958CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 02A32660, Relevance: 1.5, Strings: 1, Instructions: 215COMMON

Download Yara Rule

Strings

:@Dr, xrefs: 02A326B8

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID: :@Dr
API String ID: 0-3830894600
Opcode ID: 722dbd3dbe290ba22a461f997e964242e507157045a839460580f8f72c496c3b
Instruction ID: 89724c40002d4c8e84e02f23b518989371be1f015bacdb0067dff000419e41b5
Opcode Fuzzy Hash: 722dbd3dbe290ba22a461f997e964242e507157045a839460580f8f72c496c3b
Instruction Fuzzy Hash: 6C71CF31701314DFD726EB29E8A4B2A7BE1FF84710F05846AE9469B691DF74EC44CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02A31C41, Relevance: 1.3, Strings: 1, Instructions: 89COMMON

Download Yara Rule

Strings

</kr, xrefs: 02A31C78

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID: </kr
API String ID: 0-2427075492
Opcode ID: 5eeb8c517ceea7a55f099182f1f3806df28ebc0c3a41afe2b2278fad0dc61d64
Instruction ID: 19771652bf8fd5ad16caaba3c632682e894d2359f24bc40ed731b96af122d979
Opcode Fuzzy Hash: 5eeb8c517ceea7a55f099182f1f3806df28ebc0c3a41afe2b2278fad0dc61d64
Instruction Fuzzy Hash: 61314930B002049FDB18EBB8D494AAD7BE6AF8A324F20456AE116DB3E0DF319C458B40

Uniqueness

Uniqueness Score: -1.00%

Function 02A3014F, Relevance: 1.3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

Strings

:@Dr, xrefs: 02A301A7

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID: :@Dr
API String ID: 0-3830894600
Opcode ID: 4cab993cffde74fd6050b9e249a6dca553b3a39539171cbe8366793b21ef5d11
Instruction ID: 1f4607b167546e0279a635809f09bbee2866f575932c4a55bb037cde611e09a5
Opcode Fuzzy Hash: 4cab993cffde74fd6050b9e249a6dca553b3a39539171cbe8366793b21ef5d11
Instruction Fuzzy Hash: FE211272E01108AFDB05DFAAEC559DFBFBAEF89310F14816AE546F3260DA3059058B50

Uniqueness

Uniqueness Score: -1.00%

Function 02A328E0, Relevance: 1.3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

Strings

\,, xrefs: 02A328F2

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID: \,
API String ID: 0-2769694602
Opcode ID: c994c683084d2b8810285927d2b2f8668bfd34feadf4661f53d739f7bbbad95c
Instruction ID: 8bed05c7cb0a7ade60bc2633e3c6172d62b3aa9dce92afb644d0fbc55ded0ccf
Opcode Fuzzy Hash: c994c683084d2b8810285927d2b2f8668bfd34feadf4661f53d739f7bbbad95c
Instruction Fuzzy Hash: 3101D6606093815FD70653765C2576F7FB55FC3300B1541AAE495DB2E3CD688C09CB62

Uniqueness

Uniqueness Score: -1.00%

Function 02A328E8, Relevance: 1.3, Strings: 1, Instructions: 40COMMON

Download Yara Rule

Strings

\,, xrefs: 02A328F2

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID: \,
API String ID: 0-2769694602
Opcode ID: bedc682e612282d6830b4d91ac1486f3de2f322afa3eac75cc644a78b77667d5
Instruction ID: 0b89c59a375f093a71077b90a4881a42331950c62e00472f1b462ae27f58f633
Opcode Fuzzy Hash: bedc682e612282d6830b4d91ac1486f3de2f322afa3eac75cc644a78b77667d5
Instruction Fuzzy Hash: 1AF028206083815FD70223365C2876F3FB65FC3300B1540AAA055DB2E3CD688C09CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02A30640, Relevance: 1.3, Strings: 1, Instructions: 30COMMON

Download Yara Rule

Strings

hV, xrefs: 02A3066B

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID: hV
API String ID: 0-4113920308
Opcode ID: c08c3c935e1e03c44a214ad59c41f2b809b418b6b590243c9d2661309645fe3f
Instruction ID: 10e11f4309ee028fa966806922e4979068746d17f755d14b4045c86d3dbc2272
Opcode Fuzzy Hash: c08c3c935e1e03c44a214ad59c41f2b809b418b6b590243c9d2661309645fe3f
Instruction Fuzzy Hash: 6AE092327005208F8748AB7F981D66F3BDBEFC96217594179E60BE3364DF204D068796

Uniqueness

Uniqueness Score: -1.00%

Function 02A30007, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fca5e36a9a8f802c46958052db9063fd518d344e071fde0b9a99a00627f5b30b
Instruction ID: 070ba9a24d3997525ddb0c2b1365cbc2f149ce56c57828d736361ceb39e07a91
Opcode Fuzzy Hash: fca5e36a9a8f802c46958052db9063fd518d344e071fde0b9a99a00627f5b30b
Instruction Fuzzy Hash: 3131846050D3C18FC707A778D8656AA3FB09F83204F1949EBD4C1CF1E7DA28980AD752

Uniqueness

Uniqueness Score: -1.00%

Function 02A30530, Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bd1b1ce0321e87511eaf7946b935714514414a4c941252b7d907064e8c99f6b
Instruction ID: 13e0b739e11f2b13fb9200a1a46ef9813bc08470bea925d7825ede5c2a868891
Opcode Fuzzy Hash: 1bd1b1ce0321e87511eaf7946b935714514414a4c941252b7d907064e8c99f6b
Instruction Fuzzy Hash: C911E6303012208BC799AB7DD16463E3AD7AFC6309B24447AE40ACF7A5DE69DC419796

Uniqueness

Uniqueness Score: -1.00%

Function 02A320C0, Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 643eaef4cdf2def7cb164001fe5f70fb8acc422823ddce190b9d1d5dce347f96
Instruction ID: 731967bbbe41e66c7678f20e7df179506a6e0298d3d874733d59b9875bd97965
Opcode Fuzzy Hash: 643eaef4cdf2def7cb164001fe5f70fb8acc422823ddce190b9d1d5dce347f96
Instruction Fuzzy Hash: 06112132B442008FC711A775EC543BA7BA2AFC5311F04017AEC06D72A5EF348D08C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 02A32350, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52ebe1dc344bbcc45af53e4771aa1e3eaeffed220ff70f6d4fef7ca88593912a
Instruction ID: 4e9ce522c68e6ab129784cc445c7405451a0d02f7732bc36d3e0e40f16ae6178
Opcode Fuzzy Hash: 52ebe1dc344bbcc45af53e4771aa1e3eaeffed220ff70f6d4fef7ca88593912a
Instruction Fuzzy Hash: C801DC347041956FC709B77C94308AE3FE69FCA65030A05AAD846CB3D5EE259C02EB96

Uniqueness

Uniqueness Score: -1.00%

Function 02A505CF, Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.213750642.0000000002A50000.00000040.00000040.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439fa925028df9b9b0588bc228a79df62ecf838f75183d67258c4ac25a737afd
Instruction ID: 82cb2abc77b273d2d33866dce43a8f8c2d460e43dd10e5c3ad7605147c36fc5d
Opcode Fuzzy Hash: 439fa925028df9b9b0588bc228a79df62ecf838f75183d67258c4ac25a737afd
Instruction Fuzzy Hash: A601D6B25083806FD7128F06EC40862FFB8EB86630709C09FED898B612D235A908CB61

Uniqueness

Uniqueness Score: -1.00%

Function 02A322D0, Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bfe4fda1f17364c3ea83c607a08d93a7ce96c6df7aa615c07f75776d9823c18e
Instruction ID: fe701f66018d618d155d571e68a203e224c9a90d245fc368c550afd157809026
Opcode Fuzzy Hash: bfe4fda1f17364c3ea83c607a08d93a7ce96c6df7aa615c07f75776d9823c18e
Instruction Fuzzy Hash: DCF03C317001208FC744A7BCD468BAE3BE6AF89315F2442AAE50ACB765DE758C468B91

Uniqueness

Uniqueness Score: -1.00%

Function 02A3244B, Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f219ec4181cd03a9f6459a5a9285bedb07e773070a82713102d63b06e78404d8
Instruction ID: c8fde86242e60f3124a2c15df06b901a0f5d7430603d3dbad0946f50283b46f9
Opcode Fuzzy Hash: f219ec4181cd03a9f6459a5a9285bedb07e773070a82713102d63b06e78404d8
Instruction Fuzzy Hash: 0AF0A7323001549FC704EF2AE89489B7FE9EFCA22131045BBE509D7315CE719C05C790

Uniqueness

Uniqueness Score: -1.00%

Function 02A306C8, Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 17748800c502897314a22b4f45c8a7c8e709b70d57e850626f0cba30fe4a3bed
Instruction ID: 98c0ab89cedca29e9853dcce5e464bc876c370b3baf4d20d21f406a12c50ea82
Opcode Fuzzy Hash: 17748800c502897314a22b4f45c8a7c8e709b70d57e850626f0cba30fe4a3bed
Instruction Fuzzy Hash: E9E02B72340610AFC2015734BC0C77F77AEDBC5621F10021AF406D21D4DF60080A8752

Uniqueness

Uniqueness Score: -1.00%

Function 02A32458, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9369a3b4e22401af7c64b5701e71bbece0cfcca6b183990aa37f7c0369fbbb1a
Instruction ID: 8793fa7592c79a78417fb133a0ff5a08bf73b5e880118a3abf26a77e9e7683e9
Opcode Fuzzy Hash: 9369a3b4e22401af7c64b5701e71bbece0cfcca6b183990aa37f7c0369fbbb1a
Instruction Fuzzy Hash: FEE012363005149FC714EF2AEC9889F7B9AEBC9261351953AA50AD7354DE719C0587A0

Uniqueness

Uniqueness Score: -1.00%

Function 02A505F6, Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.213750642.0000000002A50000.00000040.00000040.sdmp, Offset: 02A50000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c2ebd95640884a13f2dff040e7510bce4d2a3380b4a613ccf318a1834ac8abd
Instruction ID: 14fae7a12e6d35aa524919356e87c9738685af43c8b67abccc4472f1658613c6
Opcode Fuzzy Hash: 5c2ebd95640884a13f2dff040e7510bce4d2a3380b4a613ccf318a1834ac8abd
Instruction Fuzzy Hash: 64E092B66006049BD650CF0BEC41452F7D8EB88630B18C47FDC0D8B701E135F504CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 02A32500, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69a0e7a7d581fb0b47e02fc106ed1ce958f0cfd3edf9fe2ef1754b90e101ad4c
Instruction ID: 51a6a7b0d3b3d2cb6815ea06599b4880f67a865b22e032fa399f736465a61c8e
Opcode Fuzzy Hash: 69a0e7a7d581fb0b47e02fc106ed1ce958f0cfd3edf9fe2ef1754b90e101ad4c
Instruction Fuzzy Hash: 23E0C2313102108BC71862ADE010A5F77DECBCA324B10407BF109CB3A1CDB5AC4547E5

Uniqueness

Uniqueness Score: -1.00%

Function 02A30251, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9fa852e26bacfd6db86c02c9abdec96389876396b0fe506011139fb9c93008d6
Instruction ID: 8ea7312e699da4019d2cecca9c22f1afa073d025d65f19904a75c7d9ce1400da
Opcode Fuzzy Hash: 9fa852e26bacfd6db86c02c9abdec96389876396b0fe506011139fb9c93008d6
Instruction Fuzzy Hash: 19D0C936B040108FDB0096ADE8041ECBBA1AFC4225B2010BAE60ADB651E92189198601

Uniqueness

Uniqueness Score: -1.00%

Function 00CA23F4, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.213579904.0000000000CA2000.00000040.00000001.sdmp, Offset: 00CA2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0d7fc98e09d3c766795726f920b0d643ca70bbdeff81ea466a0f99d3a06eec
Instruction ID: d0525ca25d5ed8a15d926ce042732e35d6af642ec2bd768aba9cc8928370070a
Opcode Fuzzy Hash: db0d7fc98e09d3c766795726f920b0d643ca70bbdeff81ea466a0f99d3a06eec
Instruction Fuzzy Hash: FBD05E79215A928FD3268A1CC1A8B953B94AB56B08F4644FDE8008B663C368DA81E200

Uniqueness

Uniqueness Score: -1.00%

Function 00CA23BC, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.213579904.0000000000CA2000.00000040.00000001.sdmp, Offset: 00CA2000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 18849843ff3f9ed74aeed37753cd7db9cf8328c646375cda45d380c163100716
Instruction ID: 9a64d0ba3589ad3c28d11e1362e0290a2be0e06e68cf1725fae7cfd124e32347
Opcode Fuzzy Hash: 18849843ff3f9ed74aeed37753cd7db9cf8328c646375cda45d380c163100716
Instruction Fuzzy Hash: 90D05E342012828BCB15DB0DC594F5937E8AB43B04F0644E8AD108B672C3A8DD81C600

Uniqueness

Uniqueness Score: -1.00%

Function 02A30130, Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13e13ab2f4167a1e26171f4f519b7ef569b2103bf1e52ebca429f13aa5e1eebc
Instruction ID: 3de596e7f56fd7fa3246f3ddc63f6c79f8ff4665971872c3a23805ee3c571db7
Opcode Fuzzy Hash: 13e13ab2f4167a1e26171f4f519b7ef569b2103bf1e52ebca429f13aa5e1eebc
Instruction Fuzzy Hash: BEC04C31754A090ADA105BF9A886767369C9780619F440475B40DC6551ED69D8554250

Uniqueness

Uniqueness Score: -1.00%

Function 02A32428, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.213739285.0000000002A30000.00000040.00000001.sdmp, Offset: 02A30000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: feba33cb848b6696683c20e09890a9c224076bdfe98a29f712f67ffc652c81e3
Instruction ID: d71a0edaa18edd77231d6e8a2463cec33405b5c9e139d06d9ae8bb05387b2151
Opcode Fuzzy Hash: feba33cb848b6696683c20e09890a9c224076bdfe98a29f712f67ffc652c81e3
Instruction Fuzzy Hash: 0AC012B0414201EFC741EF28ED4596B7BF0FB80605F84CA2DE489C2110F630551CCB52

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks. These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment. Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries.
Tactics:	Command and Control
Data Sources:	Network intrusion detection system, Network protocol analysis, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Orderpdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: NanoCore

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

AV Detection:

E-Banking Fraud:

Stealing of Sensitive Information:

Remote Access Functionality:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

E-Banking Fraud:

System Summary:

Data Obfuscation:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Remote Access Functionality:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Snort IDS Alerts